Re: Lua exposure to C vulnerabilities?

[Florian Weimer <fw@...>]

* Russell Haley:

> Thanks Florian. So does interfacing a C library (written poorly by
> me!) with Lua ‎protect me from potential vulnerabilities in that
> library?

It depends what you are doing.  Lua itself tries to prevent crashing
the program by misusing libc functions (no malloc and free, for
example).  Your Lua wrapper could do something similar.

It will not magically fix vulnerabilities that are unrelated to misuse
of library interfaces, though.

For example, if a DNS processing library has name resolution context
allocation and deallocation functions, the Lua interface could make
sure that you cannot call them in the wrong order, and thus avoid
issues related to that (use-after-free problems, for example).  But if
the DNS library crashes while processing certain DNS responses, the
Lua wrapper will not affect that at all.