lua-users home
lua-l archive

[Date Prev][Date Next][Thread Prev][Thread Next] [Date Index] [Thread Index]

>>>>> "Yongheng" == Yongheng Chen <> writes:

 Yongheng> Hi,
 Yongheng> We found a heap use after free bug in lua.

So this one seems to be something corrupting the gray lists, if I
understand the logic correctly.

What's happening is that a value (in this case a C closure) is being
pushed on the stack and then immediately freed because the current
thread stack is not being marked (which ought to be happening in the
atomic() call, but a breakpoint on traversethread() was not hit). I
think this can only happen if the current thread is marked gray (it is)
but not actually linked into any gray list...