Patrick Williams | db4c27e | 2022-08-05 08:10:29 -0500 | [diff] [blame^] | 1 | From 42d40581dd919fb134c07027ca1ce0844c670daf Mon Sep 17 00:00:00 2001 |
| 2 | From: Roberto Ierusalimschy <roberto@inf.puc-rio.br> |
| 3 | Date: Fri, 20 May 2022 13:14:33 -0300 |
| 4 | Subject: [PATCH] Save stack space while handling errors |
| 5 | |
| 6 | Because error handling (luaG_errormsg) uses slots from EXTRA_STACK, |
| 7 | and some errors can recur (e.g., string overflow while creating an |
| 8 | error message in 'luaG_runerror', or a C-stack overflow before calling |
| 9 | the message handler), the code should use stack slots with parsimony. |
| 10 | |
| 11 | This commit fixes the bug "Lua-stack overflow when C stack overflows |
| 12 | while handling an error". |
| 13 | |
| 14 | CVE: CVE-2022-33099 |
| 15 | |
| 16 | Upstream-Status: Backport [https://github.com/lua/lua/commit/42d40581dd919fb134c07027ca1ce0844c670daf] |
| 17 | |
| 18 | Signed-off-by: Khem Raj <raj.khem@gmail.com> |
| 19 | --- |
| 20 | ldebug.c | 5 ++++- |
| 21 | lvm.c | 6 ++++-- |
| 22 | 2 files changed, 8 insertions(+), 3 deletions(-) |
| 23 | |
| 24 | --- a/src/ldebug.c |
| 25 | +++ b/src/ldebug.c |
| 26 | @@ -824,8 +824,11 @@ l_noret luaG_runerror (lua_State *L, con |
| 27 | va_start(argp, fmt); |
| 28 | msg = luaO_pushvfstring(L, fmt, argp); /* format message */ |
| 29 | va_end(argp); |
| 30 | - if (isLua(ci)) /* if Lua function, add source:line information */ |
| 31 | + if (isLua(ci)) { /* if Lua function, add source:line information */ |
| 32 | luaG_addinfo(L, msg, ci_func(ci)->p->source, getcurrentline(ci)); |
| 33 | + setobjs2s(L, L->top - 2, L->top - 1); /* remove 'msg' from the stack */ |
| 34 | + L->top--; |
| 35 | + } |
| 36 | luaG_errormsg(L); |
| 37 | } |
| 38 | |
| 39 | --- a/src/lvm.c |
| 40 | +++ b/src/lvm.c |
| 41 | @@ -656,8 +656,10 @@ void luaV_concat (lua_State *L, int tota |
| 42 | /* collect total length and number of strings */ |
| 43 | for (n = 1; n < total && tostring(L, s2v(top - n - 1)); n++) { |
| 44 | size_t l = vslen(s2v(top - n - 1)); |
| 45 | - if (l_unlikely(l >= (MAX_SIZE/sizeof(char)) - tl)) |
| 46 | + if (l_unlikely(l >= (MAX_SIZE/sizeof(char)) - tl)) { |
| 47 | + L->top = top - total; /* pop strings to avoid wasting stack */ |
| 48 | luaG_runerror(L, "string length overflow"); |
| 49 | + } |
| 50 | tl += l; |
| 51 | } |
| 52 | if (tl <= LUAI_MAXSHORTLEN) { /* is result a short string? */ |
| 53 | @@ -672,7 +674,7 @@ void luaV_concat (lua_State *L, int tota |
| 54 | setsvalue2s(L, top - n, ts); /* create result */ |
| 55 | } |
| 56 | total -= n-1; /* got 'n' strings to create 1 new */ |
| 57 | - L->top -= n-1; /* popped 'n' strings and pushed one */ |
| 58 | + L->top = top - (n - 1); /* popped 'n' strings and pushed one */ |
| 59 | } while (total > 1); /* repeat until only 1 result left */ |
| 60 | } |
| 61 | |