summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools/lua
diff options
context:
space:
mode:
authorRichard Purdie <richard.purdie@linuxfoundation.org>2021-11-15 11:47:35 +0000
committerRichard Purdie <richard.purdie@linuxfoundation.org>2021-11-16 22:20:33 +0000
commit26ff8acdc9c3dbe827d0929b8738f76e6d6fdef5 (patch)
tree546e72442d8be6a6f94cc03dc910167ce1bbe0a0 /meta/recipes-devtools/lua
parent50e0aed0684526c74072ceaf8fa52964c9cc0d19 (diff)
downloadpoky-26ff8acdc9c3dbe827d0929b8738f76e6d6fdef5.tar.gz
lua: Backport fix for CVE-2021-43396
Backport the fix for CVE-2021-43396 ("C stack overflow with coroutines") from upstream. (From OE-Core rev: e74fb3f7a8171cc1293583241a9ef43a515a9320) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-devtools/lua')
-rw-r--r--meta/recipes-devtools/lua/lua/74d99057a5146755e737c479850f87fd0e3b6868.patch43
-rw-r--r--meta/recipes-devtools/lua/lua_5.4.3.bb1
2 files changed, 44 insertions, 0 deletions
diff --git a/meta/recipes-devtools/lua/lua/74d99057a5146755e737c479850f87fd0e3b6868.patch b/meta/recipes-devtools/lua/lua/74d99057a5146755e737c479850f87fd0e3b6868.patch
new file mode 100644
index 0000000000..dcdc04837d
--- /dev/null
+++ b/meta/recipes-devtools/lua/lua/74d99057a5146755e737c479850f87fd0e3b6868.patch
@@ -0,0 +1,43 @@
1From 74d99057a5146755e737c479850f87fd0e3b6868 Mon Sep 17 00:00:00 2001
2From: Roberto Ierusalimschy <roberto@inf.puc-rio.br>
3Date: Wed, 3 Nov 2021 15:04:18 -0300
4Subject: [PATCH] Bug: C stack overflow with coroutines
5
6'coroutine.resume' did not increment counter of C calls when
7continuing execution after a protected error (that is,
8while running 'precover').
9---
10 ldo.c | 6 ++++--
11 testes/cstack.lua | 14 ++++++++++++++
12 2 files changed, 18 insertions(+), 2 deletions(-)
13
14Upstream-Status: Backport [https://github.com/lua/lua/commit/74d99057a5146755e737c479850f87fd0e3b6868.patch]
15CVE: CVE-2021-43519
16
17diff --git a/src/ldo.c b/src/ldo.c
18index d0edc8b4f..66f890364 100644
19--- a/src/ldo.c
20+++ b/src/ldo.c
21@@ -759,11 +759,10 @@ static void resume (lua_State *L, void *ud) {
22 StkId firstArg = L->top - n; /* first argument */
23 CallInfo *ci = L->ci;
24 if (L->status == LUA_OK) /* starting a coroutine? */
25- ccall(L, firstArg - 1, LUA_MULTRET, 1); /* just call its body */
26+ ccall(L, firstArg - 1, LUA_MULTRET, 0); /* just call its body */
27 else { /* resuming from previous yield */
28 lua_assert(L->status == LUA_YIELD);
29 L->status = LUA_OK; /* mark that it is running (again) */
30- luaE_incCstack(L); /* control the C stack */
31 if (isLua(ci)) { /* yielded inside a hook? */
32 L->top = firstArg; /* discard arguments */
33 luaV_execute(L, ci); /* just continue running Lua code */
34@@ -814,6 +813,9 @@ LUA_API int lua_resume (lua_State *L, lua_State *from, int nargs,
35 else if (L->status != LUA_YIELD) /* ended with errors? */
36 return resume_error(L, "cannot resume dead coroutine", nargs);
37 L->nCcalls = (from) ? getCcalls(from) : 0;
38+ if (getCcalls(L) >= LUAI_MAXCCALLS)
39+ return resume_error(L, "C stack overflow", nargs);
40+ L->nCcalls++;
41 luai_userstateresume(L, nargs);
42 api_checknelems(L, (L->status == LUA_OK) ? nargs + 1 : nargs);
43 status = luaD_rawrunprotected(L, resume, &nargs);
diff --git a/meta/recipes-devtools/lua/lua_5.4.3.bb b/meta/recipes-devtools/lua/lua_5.4.3.bb
index 0224744fe7..a204242bc0 100644
--- a/meta/recipes-devtools/lua/lua_5.4.3.bb
+++ b/meta/recipes-devtools/lua/lua_5.4.3.bb
@@ -7,6 +7,7 @@ HOMEPAGE = "http://www.lua.org/"
7SRC_URI = "http://www.lua.org/ftp/lua-${PV}.tar.gz;name=tarballsrc \ 7SRC_URI = "http://www.lua.org/ftp/lua-${PV}.tar.gz;name=tarballsrc \
8 file://lua.pc.in \ 8 file://lua.pc.in \
9 ${@bb.utils.contains('DISTRO_FEATURES', 'ptest', 'http://www.lua.org/tests/lua-${PV_testsuites}-tests.tar.gz;name=tarballtest file://run-ptest ', '', d)} \ 9 ${@bb.utils.contains('DISTRO_FEATURES', 'ptest', 'http://www.lua.org/tests/lua-${PV_testsuites}-tests.tar.gz;name=tarballtest file://run-ptest ', '', d)} \
10 file://74d99057a5146755e737c479850f87fd0e3b6868.patch \
10 " 11 "
11 12
12# if no test suite matches PV release of Lua exactly, download the suite for the closest Lua release. 13# if no test suite matches PV release of Lua exactly, download the suite for the closest Lua release.