Re: heap-buffer-overflow found in luaG_errormsg

[Roberto Ierusalimschy <roberto@...>]

> Does anyone have any good ideas on how to fix issues like this? In
> fact I'm curious how the developers would treat these weird little
> bugs.

For this specific bug, the problem was that 'luaG_runerror' was using
more extra slots than it needed. The fix can be like that:


@@ -824,8 +824,11 @@ l_noret luaG_runerror (lua_State *L, const char *fmt, ...) {
   va_start(argp, fmt);
   msg = luaO_pushvfstring(L, fmt, argp);  /* format message */
   va_end(argp);
-  if (isLua(ci))  /* if Lua function, add source:line information */
+  if (isLua(ci)) {  /* if Lua function, add source:line information */
     luaG_addinfo(L, msg, ci_func(ci)->p->source, getcurrentline(ci));
+    setobjs2s(L, L->top - 2, L->top - 1);  /* remove 'msg' from the stack */
+    L->top--;
+  }
   luaG_errormsg(L);
 }


-- Roberto