[Date Prev][Date Next][Thread Prev][Thread Next]
[Date Index]
[Thread Index]
- Subject: Re: Heap overflow in luaH_get
- From: Dibyendu Majumdar <mobile@...>
- Date: Fri, 10 Jul 2020 08:51:21 +0100
On Fri, 10 Jul 2020 at 05:53, 云风 Cloud Wu <cloudwu@gmail.com> wrote:
>
> Roberto Ierusalimschy <roberto@inf.puc-rio.br> 于2020年7月9日周四 下午10:02写道：
> >
> > Exactly! I guess the correction is moving its age back to OLD0, but
> > I have to check that. Similar problems should occurr with other ages.
>
> I make a simpler test case to reveal this bug. It always crashs when I
> define a especial allocater for lua .
> It may be helpful.
>
> setmetatable ({}, { __gc = function(a) -- 1st finalizer
> setmetatable(a, { __gc = function (b) -- 2nd finalizer
> print(getmetatable(b))
> print(getmetatable(b).x) -- should be 42
> collectgarbage "step"
> collectgarbage "step"
> print(getmetatable(b))
> print(getmetatable(b).x) -- may crash !! use 2nd metatable after free
> end,
> x = 42,
> })
> a = nil
> collectgarbage "step" -- trigger 2nd finalizer
> end })
>
> collectgarbage "step" -- trigger 1st finalizer
>
Nice.
Did you try building Lua with ltests/debug support?
In Ravi, when I run this - I see GC being invoked recursively ...
should that happen?
Program received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
50 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) where
#0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1 0x00007ffff7d2c859 in __GI_abort () at abort.c:79
#2 0x00007ffff7d2c729 in __assert_fail_base (fmt=0x7ffff7ec2588
"%s%s%s:%u: %s%sAssertion `%s' failed.\n%n",
assertion=0x7ffff7f9f149 "(((x_)->tt) & 0x0F) < (9+1)",
file=0x7ffff7f9e0c8 "/home/d/github/ravi/src/lapi.c",
line=945, function=<optimized out>) at assert.c:92
#3 0x00007ffff7d3df36 in __GI___assert_fail (assertion=0x7ffff7f9f149
"(((x_)->tt) & 0x0F) < (9+1)",
file=0x7ffff7f9e0c8 "/home/d/github/ravi/src/lapi.c", line=945,
function=0x7ffff7fa08f0 <__PRETTY_FUNCTION__.5171>
"lua_getmetatable") at assert.c:101
#4 0x00007ffff7f2e76b in lua_getmetatable (L=0x55555555b2c0,
objindex=1) at /home/d/github/ravi/src/lapi.c:945
#5 0x00007ffff7f181f8 in luaB_getmetatable (L=0x55555555b2c0) at
/home/d/github/ravi/src/lbaselib.c:116
#6 0x00007ffff7f3ea3c in luaD_precall (L=0x55555555b2c0,
func=0x555555567e00, nresults=-1, op_call=1)
at /home/d/github/ravi/src/ldo.c:453
#7 0x00007ffff7f706c0 in luaV_execute (L=0x55555555b2c0) at
/home/d/github/ravi/src/lvm.c:1747
#8 0x00007ffff7f3f3bb in luaD_call (L=0x55555555b2c0,
func=0x555555567dd0, nResults=0)
at /home/d/github/ravi/src/ldo.c:604
#9 0x00007ffff7f3f41d in luaD_callnoyield (L=0x55555555b2c0,
func=0x555555567dd0, nResults=0)
at /home/d/github/ravi/src/ldo.c:615
#10 0x00007ffff7f4612f in dothecall (L=0x55555555b2c0, ud=0x0) at
/home/d/github/ravi/src/lgc.c:954
#11 0x00007ffff7f3d373 in luaD_rawrunprotected (L=0x55555555b2c0,
f=0x7ffff7f460f3 <dothecall>, ud=0x0)
at /home/d/github/ravi/src/ldo.c:157
#12 0x00007ffff7f401ef in luaD_pcall (L=0x55555555b2c0,
func=0x7ffff7f460f3 <dothecall>, u=0x0, old_top=192, ef=0)
at /home/d/github/ravi/src/ldo.c:837
#13 0x00007ffff7f464a2 in GCTM (L=0x55555555b2c0) at
/home/d/github/ravi/src/lgc.c:974
#14 0x00007ffff7f46592 in callallpendingfinalizers (L=0x55555555b2c0)
at /home/d/github/ravi/src/lgc.c:1004
#15 0x00007ffff7f46f30 in finishgencycle (L=0x55555555b2c0,
g=0x55555555b390) at /home/d/github/ravi/src/lgc.c:1251
#16 0x00007ffff7f470fa in youngcollection (L=0x55555555b2c0, g=0x55555555b390)
at /home/d/github/ravi/src/lgc.c:1287
#17 0x00007ffff7f4767d in genstep (L=0x55555555b2c0, g=0x55555555b390)
at /home/d/github/ravi/src/lgc.c:1455
#18 0x00007ffff7f4820b in luaC_step (L=0x55555555b2c0) at
/home/d/github/ravi/src/lgc.c:1693
--Type <RET> for more, q to quit, c to continue without paging--
#19 0x00007ffff7f32f98 in lua_gc (L=0x55555555b2c0, what=5) at
/home/d/github/ravi/src/lapi.c:1416
#20 0x00007ffff7f185de in luaB_collectgarbage (L=0x55555555b2c0) at
/home/d/github/ravi/src/lbaselib.c:196
#21 0x00007ffff7f3ea3c in luaD_precall (L=0x55555555b2c0,
func=0x555555567db0, nresults=0, op_call=1)
at /home/d/github/ravi/src/ldo.c:453
#22 0x00007ffff7f706c0 in luaV_execute (L=0x55555555b2c0) at
/home/d/github/ravi/src/lvm.c:1747
#23 0x00007ffff7f3f3bb in luaD_call (L=0x55555555b2c0,
func=0x55555555d260, nResults=0)
at /home/d/github/ravi/src/ldo.c:604
#24 0x00007ffff7f3f41d in luaD_callnoyield (L=0x55555555b2c0,
func=0x55555555d260, nResults=0)
at /home/d/github/ravi/src/ldo.c:615
#25 0x00007ffff7f4612f in dothecall (L=0x55555555b2c0, ud=0x0) at
/home/d/github/ravi/src/lgc.c:954
#26 0x00007ffff7f3d373 in luaD_rawrunprotected (L=0x55555555b2c0,
f=0x7ffff7f460f3 <dothecall>, ud=0x0)
at /home/d/github/ravi/src/ldo.c:157
#27 0x00007ffff7f401ef in luaD_pcall (L=0x55555555b2c0,
func=0x7ffff7f460f3 <dothecall>, u=0x0, old_top=128, ef=0)
at /home/d/github/ravi/src/ldo.c:837
#28 0x00007ffff7f464a2 in GCTM (L=0x55555555b2c0) at
/home/d/github/ravi/src/lgc.c:974
#29 0x00007ffff7f46592 in callallpendingfinalizers (L=0x55555555b2c0)
at /home/d/github/ravi/src/lgc.c:1004
#30 0x00007ffff7f46f30 in finishgencycle (L=0x55555555b2c0,
g=0x55555555b390) at /home/d/github/ravi/src/lgc.c:1251
#31 0x00007ffff7f470fa in youngcollection (L=0x55555555b2c0, g=0x55555555b390)
at /home/d/github/ravi/src/lgc.c:1287
#32 0x00007ffff7f4767d in genstep (L=0x55555555b2c0, g=0x55555555b390)
at /home/d/github/ravi/src/lgc.c:1455
#33 0x00007ffff7f4820b in luaC_step (L=0x55555555b2c0) at
/home/d/github/ravi/src/lgc.c:1693
#34 0x00007ffff7f32f98 in lua_gc (L=0x55555555b2c0, what=5) at
/home/d/github/ravi/src/lapi.c:1416
#35 0x00007ffff7f185de in luaB_collectgarbage (L=0x55555555b2c0) at
/home/d/github/ravi/src/lbaselib.c:196
#36 0x00007ffff7f3ea3c in luaD_precall (L=0x55555555b2c0,
func=0x55555555d240, nresults=0, op_call=1)
at /home/d/github/ravi/src/ldo.c:453
#37 0x00007ffff7f706c0 in luaV_execute (L=0x55555555b2c0) at
/home/d/github/ravi/src/lvm.c:1747
#38 0x00007ffff7f3f3bb in luaD_call (L=0x55555555b2c0,
func=0x55555555d230, nResults=-1)
at /home/d/github/ravi/src/ldo.c:604
#39 0x00007ffff7f3f41d in luaD_callnoyield (L=0x55555555b2c0,
func=0x55555555d230, nResults=-1)
--Type <RET> for more, q to quit, c to continue without paging--
at /home/d/github/ravi/src/ldo.c:615
#40 0x00007ffff7f32455 in f_call (L=0x55555555b2c0, ud=0x7fffffffdac0)
at /home/d/github/ravi/src/lapi.c:1284
#41 0x00007ffff7f3d373 in luaD_rawrunprotected (L=0x55555555b2c0,
f=0x7ffff7f3241c <f_call>, ud=0x7fffffffdac0)
at /home/d/github/ravi/src/ldo.c:157
#42 0x00007ffff7f401ef in luaD_pcall (L=0x55555555b2c0,
func=0x7ffff7f3241c <f_call>, u=0x7fffffffdac0, old_top=80,
ef=64) at /home/d/github/ravi/src/ldo.c:837
#43 0x00007ffff7f326a2 in lua_pcallk (L=0x55555555b2c0, nargs=0,
nresults=-1, errfunc=3, ctx=0, k=0x0)
at /home/d/github/ravi/src/lapi.c:1310
#44 0x0000555555556afb in docall (L=0x55555555b2c0, narg=0, nres=-1)
at /home/d/github/ravi/src/lua.c:209
#45 0x00005555555575f3 in handle_script (L=0x55555555b2c0, argv=0x7fffffffe010)
at /home/d/github/ravi/src/lua.c:455
#46 0x0000555555557c3a in pmain (L=0x55555555b2c0) at
/home/d/github/ravi/src/lua.c:591
#47 0x00007ffff7f3ea3c in luaD_precall (L=0x55555555b2c0,
func=0x55555555b950, nresults=1, op_call=0)
at /home/d/github/ravi/src/ldo.c:453
#48 0x00007ffff7f3f3ab in luaD_call (L=0x55555555b2c0,
func=0x55555555b950, nResults=1)
at /home/d/github/ravi/src/ldo.c:603
#49 0x00007ffff7f3f41d in luaD_callnoyield (L=0x55555555b2c0,
func=0x55555555b950, nResults=1)
at /home/d/github/ravi/src/ldo.c:615
#50 0x00007ffff7f32455 in f_call (L=0x55555555b2c0, ud=0x7fffffffdeb0)
at /home/d/github/ravi/src/lapi.c:1284
#51 0x00007ffff7f3d373 in luaD_rawrunprotected (L=0x55555555b2c0,
f=0x7ffff7f3241c <f_call>, ud=0x7fffffffdeb0)
at /home/d/github/ravi/src/ldo.c:157
#52 0x00007ffff7f401ef in luaD_pcall (L=0x55555555b2c0,
func=0x7ffff7f3241c <f_call>, u=0x7fffffffdeb0, old_top=16,
ef=0) at /home/d/github/ravi/src/ldo.c:837
#53 0x00007ffff7f326a2 in lua_pcallk (L=0x55555555b2c0, nargs=2,
nresults=1, errfunc=0, ctx=0, k=0x0)
at /home/d/github/ravi/src/lapi.c:1310
#54 0x0000555555557dda in main (argc=2, argv=0x7fffffffe008) at
/home/d/github/ravi/src/lua.c:627
