lua-users home
lua-l archive

[Date Prev][Date Next][Thread Prev][Thread Next] [Date Index] [Thread Index]


Using a negtive index in luaL_tolstring can result in wrong results.
This happens in https://github.com/lua/lua/blob/eadd8c7178c79c814ecca9652973a9b9dd4cc71b/lauxlib.c#L907-L912 where the negative index will be used in the lua_topointer call, however, a value was pushed before which changes the value the negative index points to. This can be happen in https://github.com/lua/lua/blob/dbdc74dc5502c2e05e1c1e2ac894943f418c8431/ldblib.c#L429 and the following output shows the problem:

Lua 5.4.4  Copyright (C) 1994-2021 Lua.org, PUC-Rio
> debug.debug()
lua_debug> x = {}
lua_debug> print(x)
table: 0x55627dc57140
lua_debug> error(setmetatable(x,{__name="N"}))
N: 0x55627dc57870
lua_debug> print(string.format("%p",getmetatable(x).__name))
0x55627dc57870
lua_debug>

The output N: 0x55627dc57870 prints the pointer of the string "N" instead of the pointer of the table.

Regards,
Xmilia