diff options
| author | Roberto Ierusalimschy <roberto@inf.puc-rio.br> | 2022-05-23 17:50:47 -0300 |
|---|---|---|
| committer | Roberto Ierusalimschy <roberto@inf.puc-rio.br> | 2022-05-23 17:50:47 -0300 |
| commit | 603b2c64add5fbf4b7343525cf109af0c7077695 (patch) | |
| tree | 55e8001268a5bfc92b59d3f56f8bb49757c1ff3d | |
| parent | 4a00f61276a9a38b0427fbae3dbbd86dfb5a0749 (diff) | |
| download | lua-603b2c64add5fbf4b7343525cf109af0c7077695.tar.gz lua-603b2c64add5fbf4b7343525cf109af0c7077695.tar.bz2 lua-603b2c64add5fbf4b7343525cf109af0c7077695.zip | |
'luaV_concat' can use invalidated pointer to stack
Bug introduced in commit 42d40581.
| -rw-r--r-- | lvm.c | 6 |
1 files changed, 3 insertions, 3 deletions
| @@ -643,7 +643,7 @@ void luaV_concat (lua_State *L, int total) { | |||
| 643 | int n = 2; /* number of elements handled in this pass (at least 2) */ | 643 | int n = 2; /* number of elements handled in this pass (at least 2) */ |
| 644 | if (!(ttisstring(s2v(top - 2)) || cvt2str(s2v(top - 2))) || | 644 | if (!(ttisstring(s2v(top - 2)) || cvt2str(s2v(top - 2))) || |
| 645 | !tostring(L, s2v(top - 1))) | 645 | !tostring(L, s2v(top - 1))) |
| 646 | luaT_tryconcatTM(L); | 646 | luaT_tryconcatTM(L); /* may invalidate 'top' */ |
| 647 | else if (isemptystr(s2v(top - 1))) /* second operand is empty? */ | 647 | else if (isemptystr(s2v(top - 1))) /* second operand is empty? */ |
| 648 | cast_void(tostring(L, s2v(top - 2))); /* result is first operand */ | 648 | cast_void(tostring(L, s2v(top - 2))); /* result is first operand */ |
| 649 | else if (isemptystr(s2v(top - 2))) { /* first operand is empty string? */ | 649 | else if (isemptystr(s2v(top - 2))) { /* first operand is empty string? */ |
| @@ -673,8 +673,8 @@ void luaV_concat (lua_State *L, int total) { | |||
| 673 | } | 673 | } |
| 674 | setsvalue2s(L, top - n, ts); /* create result */ | 674 | setsvalue2s(L, top - n, ts); /* create result */ |
| 675 | } | 675 | } |
| 676 | total -= n-1; /* got 'n' strings to create 1 new */ | 676 | total -= n - 1; /* got 'n' strings to create one new */ |
| 677 | L->top = top - (n - 1); /* popped 'n' strings and pushed one */ | 677 | L->top -= n - 1; /* popped 'n' strings and pushed one */ |
| 678 | } while (total > 1); /* repeat until only 1 result left */ | 678 | } while (total > 1); /* repeat until only 1 result left */ |
| 679 | } | 679 | } |
| 680 | 680 | ||