Re: Heap overflow in luaH_get

[云风 Cloud Wu <cloudwu@...>]

Roberto Ierusalimschy <roberto@inf.puc-rio.br> 于2020年7月9日周四 下午10:02写道：
>
> Exactly! I guess the correction is moving its age back to OLD0, but
> I have to check that. Similar problems should occurr with other ages.

I make a simpler test case to reveal this bug. It always crashs when I
define a especial allocater for lua .
It may be helpful.

setmetatable ({}, { __gc = function(a) -- 1st finalizer
   setmetatable(a, { __gc = function (b) -- 2nd finalizer
     print(getmetatable(b))
     print(getmetatable(b).x) -- should be 42
     collectgarbage "step"
     collectgarbage "step"
     print(getmetatable(b))
     print(getmetatable(b).x) -- may crash !! use 2nd metatable after free
   end,
   x = 42,
   })
   a = nil
   collectgarbage "step" -- trigger 2nd finalizer
end })

collectgarbage "step" -- trigger 1st finalizer

-- 
http://blog.codingnow.com