aboutsummaryrefslogtreecommitdiff
path: root/lvm.c
diff options
context:
space:
mode:
authorRoberto Ierusalimschy <roberto@inf.puc-rio.br>2022-05-23 17:50:47 -0300
committerRoberto Ierusalimschy <roberto@inf.puc-rio.br>2022-05-23 17:50:47 -0300
commit603b2c64add5fbf4b7343525cf109af0c7077695 (patch)
tree55e8001268a5bfc92b59d3f56f8bb49757c1ff3d /lvm.c
parent4a00f61276a9a38b0427fbae3dbbd86dfb5a0749 (diff)
downloadlua-603b2c64add5fbf4b7343525cf109af0c7077695.tar.gz
lua-603b2c64add5fbf4b7343525cf109af0c7077695.tar.bz2
lua-603b2c64add5fbf4b7343525cf109af0c7077695.zip
'luaV_concat' can use invalidated pointer to stack
Bug introduced in commit 42d40581.
Diffstat (limited to 'lvm.c')
-rw-r--r--lvm.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/lvm.c b/lvm.c
index cd992aad..614df055 100644
--- a/lvm.c
+++ b/lvm.c
@@ -643,7 +643,7 @@ void luaV_concat (lua_State *L, int total) {
643 int n = 2; /* number of elements handled in this pass (at least 2) */ 643 int n = 2; /* number of elements handled in this pass (at least 2) */
644 if (!(ttisstring(s2v(top - 2)) || cvt2str(s2v(top - 2))) || 644 if (!(ttisstring(s2v(top - 2)) || cvt2str(s2v(top - 2))) ||
645 !tostring(L, s2v(top - 1))) 645 !tostring(L, s2v(top - 1)))
646 luaT_tryconcatTM(L); 646 luaT_tryconcatTM(L); /* may invalidate 'top' */
647 else if (isemptystr(s2v(top - 1))) /* second operand is empty? */ 647 else if (isemptystr(s2v(top - 1))) /* second operand is empty? */
648 cast_void(tostring(L, s2v(top - 2))); /* result is first operand */ 648 cast_void(tostring(L, s2v(top - 2))); /* result is first operand */
649 else if (isemptystr(s2v(top - 2))) { /* first operand is empty string? */ 649 else if (isemptystr(s2v(top - 2))) { /* first operand is empty string? */
@@ -673,8 +673,8 @@ void luaV_concat (lua_State *L, int total) {
673 } 673 }
674 setsvalue2s(L, top - n, ts); /* create result */ 674 setsvalue2s(L, top - n, ts); /* create result */
675 } 675 }
676 total -= n-1; /* got 'n' strings to create 1 new */ 676 total -= n - 1; /* got 'n' strings to create one new */
677 L->top = top - (n - 1); /* popped 'n' strings and pushed one */ 677 L->top -= n - 1; /* popped 'n' strings and pushed one */
678 } while (total > 1); /* repeat until only 1 result left */ 678 } while (total > 1); /* repeat until only 1 result left */
679} 679}
680 680