Re: heap-buffer-overflow in getobjname

[Andrew Gierth <andrew@...>]

>>>>> "Rui" == Rui Zhong <reversezr33@gmail.com> writes:

 Rui> READ of size 4 at 0x60200000014c thread T0
 Rui>     #0 0x40e7ca in getobjname (/home/yongheng/lua_asan/lua+0x40e7ca)
 Rui>     #1 0x40ec98 in varinfo (/home/yongheng/lua_asan/lua+0x40ec98)
 Rui>     #2 0x411575 in luaG_typeerror (/home/yongheng/lua_asan/lua+0x411575)
 Rui>     #3 0x4138bc in luaD_tryfuncTM (/home/yongheng/lua_asan/lua+0x4138bc)

So the problem here seems to be that the current CallInfo is that of
some Lua function, and where the garbage collector was run before any
savepc() operation (to be precise, from an OP_NEWTABLE opcode). The GC
then tried to call the __gc metamethod of an object, got the "coroutine"
table rather than a function, tried to get a __call metamethod from
that, got nil, and tried to throw an error. Because varinfo thinks that
it was a Lua function that caused the error, it tries to look at the
bytecode to see where the value came from, and reads from before the
start of the bytecode because savedpc still points to the first opcode
(it tries to read the opcode at savedpc-1).

-- 
Andrew.