Re: Error handling with To-be-closed variable declared inside coroutine causes use-after-free read/write

Nope, there is no special reason for that. Variable name was automatically set as 'pcall' (in line 3 and line 6)from the fuzzer.

It would be better to replace them with other names such as 'x' to not get confused, as below.

----------------------------------------------------------------------------------------------------------

1 co = coroutine.wrap(

2 function()

3 local x <close> = setmetatable(

4 {}, {__close = function() pcall(co) end}

5 )

6 x()

7 end

8 )

9 co()

Minseok Kang

2021년 11월 3일 (수) 오전 1:23, Roberto Ierusalimschy <roberto@inf.puc-rio.br>님이 작성:

> I found an interesting crash on Lua interpreter.
> (Ubuntu 20.04 LTS / glibc 2.3.1 / Lua 5.4.4 commit hash
> 0e5071b5fbcc244d9f8c4bae82e327ad59bccc3f)
>
> Code below generates use after read crash with address-sanitizer applied.
> ---------------------------------------------------------------------------------------------------
> 1 co = coroutine.wrap(
> 2 function()
> 3 local pcall <close> = setmetatable(
> 4 {}, {__close = function() pcall(co) end}
> 5 )
> 6 pcall()
> 7 end
> 8 )
> 9 co()
> [...]

Many thanks for the report. (Is there any special reason to call
the variable 'pcall'? The crash seems to happen with any name.)

-- Roberto