Re: Heap use after free in luaD_tryfuncTM

[Roberto Ierusalimschy <roberto@...>]

> In https://github.com/lua/lua/blob/e8deac5a41ffd644aaa78fda6d4bd5caa72cb077/ldo.c#L391-L393
> a use after free can occure if checkstackGCp calls a garbage collector
> which rehashes the metatable into which the tm pointer points.

Many thanks for the report. (How did you find this bug? Just
inspection?) I believe this small change should fix the issue:

 StkId luaD_tryfuncTM (lua_State *L, StkId func) {
-  const TValue *tm = luaT_gettmbyobj(L, s2v(func), TM_CALL);
+  const TValue *tm;
   StkId p;
   checkstackGCp(L, 1, func);  /* space for metamethod */
+  tm = luaT_gettmbyobj(L, s2v(func), TM_CALL);
   if (l_unlikely(ttisnil(tm)))
     luaG_callerror(L, s2v(func));  /* nothing to call */

-- Roberto