Re: Bug with SETLIST causes Lua to crash

[Roberto Ierusalimschy <roberto@...>]

> I've noticed that it is possible to use 'debug.setlocal' inside of a table
> constructor to modify the stack value in which SETLIST will write to. By
> using this function you can overwrite the table in the stack to be other
> values, or just values that aren't tables at all. When setting the value to
> something other than a table, instead of erroring, Lua will crash. [...]

>From the manual:

    * The Debug Library

    [...] You should exert care when using this library.  Several of its
    functions violate basic assumptions about Lua code (e.g., [...] that
    Lua programs do not crash) and therefore can compromise otherwise
    secure code.

-- Roberto