lua/lvm.c, branch v5.4.9A mirror of https://github.com/lua/lua
https://git.lua4.win/lua/atom?h=v5.4.92026-07-13T18:55:36+00:00Bug: Issues with write barrier for __newindex2026-07-13T18:55:36+00:00Roberto Iroberto@inf.puc-rio.br2026-07-13T18:55:36+00:00urn:sha1:0f781f836ab348716eb9232d3831a871b9821a3c
In 'luaV_finishset', there is an update on a table that is a field on
another table. If the first table is the same as the one with the field
(e.g., after 't.__newindex = t'), the update can change the value on
that field (if the field being updated is '__newindex' itself). After
that, the barrier is called with the table stored in that field, which
is not the correct table anymore.
Bug: Use after free in 'luaV_finishset'2025-03-13T18:42:39+00:00Roberto Ierusalimschyroberto@inf.puc-rio.br2025-03-13T18:42:39+00:00urn:sha1:983bc433e6a60cbc4fe3a16f1d4713bacb8e3509
If a metatable is a weak table, its __newindex field could be collected
by an emergency collection while being used in 'luaV_finishset'. (This
bug has similarities with bug 5.3.2-1, fixed in commit a272fa66.)
Towards release 5.4.72024-04-26T17:55:18+00:00Roberto Ierusalimschyroberto@inf.puc-rio.br2024-04-26T17:55:18+00:00urn:sha1:de794a6527058e75b674118b35f39dcbb13e88b1Bug: Buffer overflow in string concatenation2023-12-21T16:37:51+00:00Roberto Ierusalimschyroberto@inf.puc-rio.br2023-12-21T16:37:51+00:00urn:sha1:5853c37a83ec66ccb45094f9aeac23dfdbcde671
Even if the string fits in size_t, the whole size of the TString object
can overflow when we add the header.
More disciplined use of 'getstr' and 'tsslen'2023-08-17T18:59:28+00:00Roberto Ierusalimschyroberto@inf.puc-rio.br2023-08-17T18:59:28+00:00urn:sha1:9b4f39ab14fb2e55345c3d23537d129dac23b091
We may want to add other string variants in the future; this change
documents better where the code may need to handle those variants.
Bug: Call hook may be called twice when count hook yields2023-07-25T19:50:44+00:00Roberto Ierusalimschyroberto@inf.puc-rio.br2023-07-25T19:50:44+00:00urn:sha1:1b3f507f620d996ffb69da7476a19251acfb89ca
Took the opportunity and moved the code that controls call hooks
in 'luaV_execute' into a function.
Bug: read overflow in 'l_strcmp'2023-06-14T17:38:07+00:00Roberto Ierusalimschyroberto@inf.puc-rio.br2023-06-14T17:38:07+00:00urn:sha1:f623b969325be736297bc1dff48e763c08778243
Equality according to 'strcoll' does not imply that strings have
the same length.
Details2023-05-15T13:07:25+00:00Roberto Ierusalimschyroberto@inf.puc-rio.br2023-05-15T13:07:25+00:00urn:sha1:934e77a286aeb97ca02badf56956ccc78217e9d0
- Better comments about short strings in opcodes.
- luaH_newkey made static.
Bug: Wrong line in error message for arith. errors2023-02-08T17:15:41+00:00Roberto Ierusalimschyroberto@inf.puc-rio.br2023-02-08T17:15:41+00:00urn:sha1:02bab9fc258fe1cbc6088b1bd61193499d058eff
It also causes 'L->top' to be wrong when the error happens,
triggering an 'assert'.
Stack indices changed to union's2022-10-29T15:06:37+00:00Roberto Ierusalimschyroberto@inf.puc-rio.br2022-10-29T15:06:37+00:00urn:sha1:413a393e6222482f46599e138bebac162610a572
That will allow to change pointers to offsets while reallocating
the stack.