diff options
Diffstat (limited to 'meta/recipes-devtools/lua/lua/74d99057a5146755e737c479850f87fd0e3b6868.patch')
-rw-r--r-- | meta/recipes-devtools/lua/lua/74d99057a5146755e737c479850f87fd0e3b6868.patch | 43 |
1 files changed, 0 insertions, 43 deletions
diff --git a/meta/recipes-devtools/lua/lua/74d99057a5146755e737c479850f87fd0e3b6868.patch b/meta/recipes-devtools/lua/lua/74d99057a5146755e737c479850f87fd0e3b6868.patch deleted file mode 100644 index dcdc04837d..0000000000 --- a/meta/recipes-devtools/lua/lua/74d99057a5146755e737c479850f87fd0e3b6868.patch +++ /dev/null | |||
@@ -1,43 +0,0 @@ | |||
1 | From 74d99057a5146755e737c479850f87fd0e3b6868 Mon Sep 17 00:00:00 2001 | ||
2 | From: Roberto Ierusalimschy <roberto@inf.puc-rio.br> | ||
3 | Date: Wed, 3 Nov 2021 15:04:18 -0300 | ||
4 | Subject: [PATCH] Bug: C stack overflow with coroutines | ||
5 | |||
6 | 'coroutine.resume' did not increment counter of C calls when | ||
7 | continuing execution after a protected error (that is, | ||
8 | while running 'precover'). | ||
9 | --- | ||
10 | ldo.c | 6 ++++-- | ||
11 | testes/cstack.lua | 14 ++++++++++++++ | ||
12 | 2 files changed, 18 insertions(+), 2 deletions(-) | ||
13 | |||
14 | Upstream-Status: Backport [https://github.com/lua/lua/commit/74d99057a5146755e737c479850f87fd0e3b6868.patch] | ||
15 | CVE: CVE-2021-43519 | ||
16 | |||
17 | diff --git a/src/ldo.c b/src/ldo.c | ||
18 | index d0edc8b4f..66f890364 100644 | ||
19 | --- a/src/ldo.c | ||
20 | +++ b/src/ldo.c | ||
21 | @@ -759,11 +759,10 @@ static void resume (lua_State *L, void *ud) { | ||
22 | StkId firstArg = L->top - n; /* first argument */ | ||
23 | CallInfo *ci = L->ci; | ||
24 | if (L->status == LUA_OK) /* starting a coroutine? */ | ||
25 | - ccall(L, firstArg - 1, LUA_MULTRET, 1); /* just call its body */ | ||
26 | + ccall(L, firstArg - 1, LUA_MULTRET, 0); /* just call its body */ | ||
27 | else { /* resuming from previous yield */ | ||
28 | lua_assert(L->status == LUA_YIELD); | ||
29 | L->status = LUA_OK; /* mark that it is running (again) */ | ||
30 | - luaE_incCstack(L); /* control the C stack */ | ||
31 | if (isLua(ci)) { /* yielded inside a hook? */ | ||
32 | L->top = firstArg; /* discard arguments */ | ||
33 | luaV_execute(L, ci); /* just continue running Lua code */ | ||
34 | @@ -814,6 +813,9 @@ LUA_API int lua_resume (lua_State *L, lua_State *from, int nargs, | ||
35 | else if (L->status != LUA_YIELD) /* ended with errors? */ | ||
36 | return resume_error(L, "cannot resume dead coroutine", nargs); | ||
37 | L->nCcalls = (from) ? getCcalls(from) : 0; | ||
38 | + if (getCcalls(L) >= LUAI_MAXCCALLS) | ||
39 | + return resume_error(L, "C stack overflow", nargs); | ||
40 | + L->nCcalls++; | ||
41 | luai_userstateresume(L, nargs); | ||
42 | api_checknelems(L, (L->status == LUA_OK) ? nargs + 1 : nargs); | ||
43 | status = luaD_rawrunprotected(L, resume, &nargs); | ||