Re: heap-buffer-overflow in luaD_pretailcall

[Yongheng Chen <changochen1@...>]

Hi,

We generate these test cases through fuzzing. The original test case is bigger, and we use 
C-reduce to reduce the test case. We can provide the original one if needed.


Yongheng

> On Jul 7, 2020, at 3:04 PM, Petite Abeille <petite.abeille@gmail.com> wrote:
> 
> 
> 
>> On Jul 7, 2020, at 20:34, Roberto Ierusalimschy <roberto@inf.puc-rio.br> wrote:
>> 
>> My question was how they generate the Lua code that trigger those
>> issues.  I am not sure whether they can be simplified; the code is quite
>> convoluted.
> 
> Interestingly, Yongheng & Rui have put sqlite through the same regime, with the same results. 
> 
> Some kind of code generation fuzzer of sort.
> 
> For example:
> 
> https://www.mail-archive.com/sqlite-users@mailinglists.sqlite.org/msg117794.html
> 
>