Projects
Mega:23.03
lua
_service:tar_scm:backport-CVE-2022-33099.patch
Sign Up
Log In
Username
Password
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File _service:tar_scm:backport-CVE-2022-33099.patch of Package lua
From 42d40581dd919fb134c07027ca1ce0844c670daf Mon Sep 17 00:00:00 2001 From: Roberto Ierusalimschy <roberto@inf.puc-rio.br> Date: Fri, 20 May 2022 13:14:33 -0300 Subject: [PATCH] Save stack space while handling errors Because error handling (luaG_errormsg) uses slots from EXTRA_STACK, and some errors can recur (e.g., string overflow while creating an error message in 'luaG_runerror', or a C-stack overflow before calling the message handler), the code should use stack slots with parsimony. This commit fixes the bug "Lua-stack overflow when C stack overflows while handling an error". --- src/ldebug.c | 5 ++++- src/lvm.c | 6 ++++-- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/src/ldebug.c b/src/ldebug.c index 1feaab2..5524fae 100644 --- a/src/ldebug.c +++ b/src/ldebug.c @@ -783,8 +783,11 @@ l_noret luaG_runerror (lua_State *L, const char *fmt, ...) { va_start(argp, fmt); msg = luaO_pushvfstring(L, fmt, argp); /* format message */ va_end(argp); - if (isLua(ci)) /* if Lua function, add source:line information */ + if (isLua(ci)) { /* if Lua function, add source:line information */ luaG_addinfo(L, msg, ci_func(ci)->p->source, getcurrentline(ci)); + setobjs2s(L, L->top - 2, L->top - 1); /* remove 'msg' from the stack */ + L->top--; + } luaG_errormsg(L); } diff --git a/src/lvm.c b/src/lvm.c index c9729bc..a965087 100644 --- a/src/lvm.c +++ b/src/lvm.c @@ -656,8 +656,10 @@ void luaV_concat (lua_State *L, int total) { /* collect total length and number of strings */ for (n = 1; n < total && tostring(L, s2v(top - n - 1)); n++) { size_t l = vslen(s2v(top - n - 1)); - if (l_unlikely(l >= (MAX_SIZE/sizeof(char)) - tl)) + if (l_unlikely(l >= (MAX_SIZE/sizeof(char)) - tl)) { + L->top = top - total; /* pop strings to avoid wasting stack */ luaG_runerror(L, "string length overflow"); + } tl += l; } if (tl <= LUAI_MAXSHORTLEN) { /* is result a short string? */ @@ -672,7 +674,7 @@ void luaV_concat (lua_State *L, int total) { setsvalue2s(L, top - n, ts); /* create result */ } total -= n-1; /* got 'n' strings to create 1 new */ - L->top -= n-1; /* popped 'n' strings and pushed one */ + L->top = top - (n - 1); /* popped 'n' strings and pushed one */ } while (total > 1); /* repeat until only 1 result left */ } -- 2.33.0
Locations
Projects
Search
Status Monitor
Help
Open Build Service
OBS Manuals
API Documentation
OBS Portal
Reporting a Bug
Contact
Mailing List
Forums
Chat (IRC)
Twitter
Open Build Service (OBS)
is an
openSUSE project
.
浙ICP备2022010568号-2