diff options
| author | Roberto Ierusalimschy <roberto@inf.puc-rio.br> | 2022-05-25 17:41:39 -0300 |
|---|---|---|
| committer | Roberto Ierusalimschy <roberto@inf.puc-rio.br> | 2022-05-25 17:41:39 -0300 |
| commit | 196bb94d66e727e0aec053a0276c3ad701500762 (patch) | |
| tree | a7639f32207179b5bd5e1ce04dd35972e1b2e148 /lapi.c | |
| parent | 603b2c64add5fbf4b7343525cf109af0c7077695 (diff) | |
| download | lua-196bb94d66e727e0aec053a0276c3ad701500762.tar.gz lua-196bb94d66e727e0aec053a0276c3ad701500762.tar.bz2 lua-196bb94d66e727e0aec053a0276c3ad701500762.zip | |
Bug: 'lua_settop' may use an invalid pointer to stack
Diffstat (limited to 'lapi.c')
| -rw-r--r-- | lapi.c | 5 |
1 files changed, 2 insertions, 3 deletions
| @@ -197,7 +197,7 @@ LUA_API void lua_settop (lua_State *L, int idx) { | |||
| 197 | newtop = L->top + diff; | 197 | newtop = L->top + diff; |
| 198 | if (diff < 0 && L->tbclist >= newtop) { | 198 | if (diff < 0 && L->tbclist >= newtop) { |
| 199 | lua_assert(hastocloseCfunc(ci->nresults)); | 199 | lua_assert(hastocloseCfunc(ci->nresults)); |
| 200 | luaF_close(L, newtop, CLOSEKTOP, 0); | 200 | newtop = luaF_close(L, newtop, CLOSEKTOP, 0); |
| 201 | } | 201 | } |
| 202 | L->top = newtop; /* correct top only after closing any upvalue */ | 202 | L->top = newtop; /* correct top only after closing any upvalue */ |
| 203 | lua_unlock(L); | 203 | lua_unlock(L); |
| @@ -210,8 +210,7 @@ LUA_API void lua_closeslot (lua_State *L, int idx) { | |||
| 210 | level = index2stack(L, idx); | 210 | level = index2stack(L, idx); |
| 211 | api_check(L, hastocloseCfunc(L->ci->nresults) && L->tbclist == level, | 211 | api_check(L, hastocloseCfunc(L->ci->nresults) && L->tbclist == level, |
| 212 | "no variable to close at given level"); | 212 | "no variable to close at given level"); |
| 213 | luaF_close(L, level, CLOSEKTOP, 0); | 213 | level = luaF_close(L, level, CLOSEKTOP, 0); |
| 214 | level = index2stack(L, idx); /* stack may be moved */ | ||
| 215 | setnilvalue(s2v(level)); | 214 | setnilvalue(s2v(level)); |
| 216 | lua_unlock(L); | 215 | lua_unlock(L); |
| 217 | } | 216 | } |