lua-users home
lua-l archive

[Date Prev][Date Next][Thread Prev][Thread Next] [Date Index] [Thread Index]

> In
> a use after free can occure if checkstackGCp calls a garbage collector
> which rehashes the metatable into which the tm pointer points.

Many thanks for the report. (How did you find this bug? Just
inspection?) I believe this small change should fix the issue:

 StkId luaD_tryfuncTM (lua_State *L, StkId func) {
-  const TValue *tm = luaT_gettmbyobj(L, s2v(func), TM_CALL);
+  const TValue *tm;
   StkId p;
   checkstackGCp(L, 1, func);  /* space for metamethod */
+  tm = luaT_gettmbyobj(L, s2v(func), TM_CALL);
   if (l_unlikely(ttisnil(tm)))
     luaG_callerror(L, s2v(func));  /* nothing to call */

-- Roberto