readme: add known issues

Author: ligurio

README.md

@@ -66,6 +66,52 @@ cd build && RUNS=100000 ctest -R luaL_gsub_test --verbose
 - [Lua 5.2 Reference Manual: 4 – The Application Program Interface](https://www.lua.org/manual/5.2/manual.html#4)
 - [Lua 5.1 Reference Manual: 3 – The Application Program Interface](https://www.lua.org/manual/5.1/manual.html#3)
 
+### Known Issues
+
+Fuzzing can find a wide variety of problems, but not all problems
+are considered bugs. Some problems are due to known limitations in
+the implementation. This section contains a list of such
+limitations in LuaJIT and PUC Rio Lua:
+
+1. In LuaJIT, the build infrastructure includes a source code that
+   contains memory leaks and other problems. For example,
+   `src/host/buildvm.c` and `src/host/minilua.c`, these files are
+   only used during the LuaJIT build process, and they are not
+   a part of the LuaJIT itself. Memory leaks are suppressed in
+   AddressSanitizer with a function `__lsan_is_turned_off()` that
+   disallows leak checking for the program it is linked into.
+1. In LuaJIT a function `lj_str_new()` may read past a buffer end
+   (so-called "dirty" read) and that's ok. Suppressed in
+   AddressSanitizer with `__attribute__((no_sanitize_address))`.
+1. In LuaJIT, bytecode input is unsafe, see [LuaJIT#847][LuaJIT#847]
+   and [LuaJIT FAQ][LuaJIT FAQ]. The string "mode" controls
+   whether the chunk can be text or binary (that is, a precompiled
+   chunk). It may be the string "b" (only binary chunks),
+   "t" (only text chunks), or "bt" (both binary and text). The
+   default is "bt". PUC Rio Lua and LuaJIT both have bytecode and
+   Lua source code parsers. It is desired to test both
+   parsers; however, the LuaJIT bytecode parser failed with the
+   assertion: LuaJIT ASSERT `lj_bcread.c:123: bcread_byte: buffer
+   read overflow`, so with LuaJIT only text mode is used, and
+   therefore only the text parser is tested.
+1. The `debug` library is defined as unsafe. There are tons of ways
+   to produce a crash with it. This library provides the functionality
+   of the debug interface to Lua programs. Several of its functions
+   violate basic assumptions about Lua code and therefore can
+   compromise otherwise secure code. See [LuaJIT#1264][LuaJIT#1264]
+   and [Lua 5.4 Reference Manual][refmanual54]. The `debug`
+   functions is not a subject of testing and these functions are
+   used carefully.
+1. In LuaJIT there are a number of places with undefined behavior
+   ("nonnull-attribute", "signed-integer-overflow", "bounds").
+   These problems remain unfixed and suppressed in
+   UndefinedBehavior Sanitizer.
+
+[LuaJIT#847]: https://github.com/LuaJIT/LuaJIT/issues/847
+[LuaJIT#1264]: https://github.com/LuaJIT/LuaJIT/issues/1264
+[LuaJIT FAQ]: https://luajit.org/faq.html#sandbox
+[refmanual54]: https://www.lua.org/manual/5.4/manual.html#6.10
+
 ### License
 
 Copyright (C) 2022-2025 [Sergey Bronnikov](https://bronevichok.ru/),