That code is from “ Programming in Lua by Roberto Ierusalimschy, which was written for Lua 5.0. Now Lua is at version 5.1, that work is a little out of date but still useful as a starting point.

The weakness allows a null byte injected in the username field to bypass authentication and insert malicious Lua code into session files.