lua-users home
lua-l archive

[Date Prev][Date Next][Thread Prev][Thread Next] [Date Index] [Thread Index]


Roberto Ierusalimschy wrote:
> > If a function's upvalues pointed to all the instances of that function
> > on the stack, and assuming that the function does not exist in any
> > tables, then if that function set all of it's upvalues to nil, and
> > then a GC collection, then it would cause itself to be collected. This
> > then causes all kinds of fun (i.e. segfaults) as the current
> > environment table has probably just been collected as well.
> 
> Could you explain better? I am afraid I cannot understand what you have
> done.

My take on it: the modified bytecode verifies ok, but crashes when
run since the currently running function is collected. Normally
this can't happen because there's always a reference to it at
L->func = L->base-1. But the upvalue can be maliciously redirected
to overwrite this stack slot.

Summary: it's a bug in the bytecode verifier.

--Mike