debug.sethook/gethook may overflow the thread's stack

1 files changed, 46 insertions, 0 deletions

diff --git a/bugs b/bugs
index 8254da03..8943a56b 100644
--- a/bugs
+++ b/bugs
@@ -1637,6 +1637,52 @@ lua.c:
 }
 
 Bug{
+what = [[debug.sethook/gethook may overflow the thread's stack]],
+report = [[Ivko Stanilov, on 2008/01/04]],
+since = [[5.1]],
+example = [[
+a = coroutine.create(function() yield() end) 
+coroutine.resume(a)
+debug.sethook(a)      -- may overflow the stack of 'a'
+]],
+patch = [[ ]],
+ldblib.c:
+@@ -268,12 +268,11 @@
+     count = luaL_optint(L, arg+3, 0);
+     func = hookf; mask = makemask(smask, count);
+   }
+-  gethooktable(L1);
+-  lua_pushlightuserdata(L1, L1);
++  gethooktable(L);
++  lua_pushlightuserdata(L, L1);
+   lua_pushvalue(L, arg+1);
+-  lua_xmove(L, L1, 1);
+-  lua_rawset(L1, -3);  /* set new hook */
+-  lua_pop(L1, 1);  /* remove hook table */
++  lua_rawset(L, -3);  /* set new hook */
++  lua_pop(L, 1);  /* remove hook table */
+   lua_sethook(L1, func, mask, count);  /* set hooks */
+   return 0;
+ }
+@@ -288,11 +287,10 @@
+   if (hook != NULL && hook != hookf)  /* external hook? */
+     lua_pushliteral(L, "external hook");
+   else {
+-    gethooktable(L1);
+-    lua_pushlightuserdata(L1, L1);
+-    lua_rawget(L1, -2);   /* get hook */
+-    lua_remove(L1, -2);  /* remove hook table */
+-    lua_xmove(L1, L, 1);
++    gethooktable(L);
++    lua_pushlightuserdata(L, L1);
++    lua_rawget(L, -2);   /* get hook */
++    lua_remove(L, -2);  /* remove hook table */
+   }
+   lua_pushstring(L, unmakemask(mask, buff));
+   lua_pushinteger(L, lua_gethookcount(L1));
+}
+
+Bug{
 what = [[ ]],
 report = [[ , on ]],
 since = [[i ]],