lua/backport-CVE-2021-45985.patch
Chen Ziyang b07366fdc6 fix CVE-2021-45985
(cherry picked from commit 89c61e7fa4b57456285e2cde7143c2cdf053d79e)
2023-04-19 10:41:15 +08:00

35 lines
1.2 KiB
Diff

From cf613cdc6fa367257fc61c256f63d917350858b5 Mon Sep 17 00:00:00 2001
From: Roberto Ierusalimschy <roberto@inf.puc-rio.br>
Date: Wed, 15 Dec 2021 11:29:07 -0300
Subject: [PATCH] Bug: finalizers can be called with an invalid stack
The call to 'checkstackGC' can run finalizers, which will find an
inconsistent CallInfo, as 'ci' is half updated at the point of call.
Reference:https://github.com/lua/lua/commit/cf613cdc6fa367257fc61c256f63d917350858b5
Conflict:NA
---
src/ldo.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/ldo.c b/src/ldo.c
index f282a773..a48e35f9 100644
--- a/src/ldo.c
+++ b/src/ldo.c
@@ -530,10 +530,10 @@ int luaD_pretailcall (lua_State *L, CallInfo *ci, StkId func,
int fsize = p->maxstacksize; /* frame size */
int nfixparams = p->numparams;
int i;
+ checkstackGCp(L, fsize - delta, func);
ci->func -= delta; /* restore 'func' (if vararg) */
for (i = 0; i < narg1; i++) /* move down function and arguments */
setobjs2s(L, ci->func + i, func + i);
- checkstackGC(L, fsize);
func = ci->func; /* moved-down function */
for (; narg1 <= nfixparams; narg1++)
setnilvalue(s2v(func + narg1)); /* complete missing arguments */
--
2.33.0