diff options
author | Roberto Ierusalimschy <roberto@inf.puc-rio.br> | 2022-05-23 17:50:47 -0300 |
---|---|---|
committer | Roberto Ierusalimschy <roberto@inf.puc-rio.br> | 2022-05-23 17:50:47 -0300 |
commit | 603b2c64add5fbf4b7343525cf109af0c7077695 (patch) | |
tree | 55e8001268a5bfc92b59d3f56f8bb49757c1ff3d /lvm.c | |
parent | 4a00f61276a9a38b0427fbae3dbbd86dfb5a0749 (diff) | |
download | lua-603b2c64add5fbf4b7343525cf109af0c7077695.tar.gz lua-603b2c64add5fbf4b7343525cf109af0c7077695.tar.bz2 lua-603b2c64add5fbf4b7343525cf109af0c7077695.zip |
'luaV_concat' can use invalidated pointer to stack
Bug introduced in commit 42d40581.
Diffstat (limited to 'lvm.c')
-rw-r--r-- | lvm.c | 6 |
1 files changed, 3 insertions, 3 deletions
@@ -643,7 +643,7 @@ void luaV_concat (lua_State *L, int total) { | |||
643 | int n = 2; /* number of elements handled in this pass (at least 2) */ | 643 | int n = 2; /* number of elements handled in this pass (at least 2) */ |
644 | if (!(ttisstring(s2v(top - 2)) || cvt2str(s2v(top - 2))) || | 644 | if (!(ttisstring(s2v(top - 2)) || cvt2str(s2v(top - 2))) || |
645 | !tostring(L, s2v(top - 1))) | 645 | !tostring(L, s2v(top - 1))) |
646 | luaT_tryconcatTM(L); | 646 | luaT_tryconcatTM(L); /* may invalidate 'top' */ |
647 | else if (isemptystr(s2v(top - 1))) /* second operand is empty? */ | 647 | else if (isemptystr(s2v(top - 1))) /* second operand is empty? */ |
648 | cast_void(tostring(L, s2v(top - 2))); /* result is first operand */ | 648 | cast_void(tostring(L, s2v(top - 2))); /* result is first operand */ |
649 | else if (isemptystr(s2v(top - 2))) { /* first operand is empty string? */ | 649 | else if (isemptystr(s2v(top - 2))) { /* first operand is empty string? */ |
@@ -673,8 +673,8 @@ void luaV_concat (lua_State *L, int total) { | |||
673 | } | 673 | } |
674 | setsvalue2s(L, top - n, ts); /* create result */ | 674 | setsvalue2s(L, top - n, ts); /* create result */ |
675 | } | 675 | } |
676 | total -= n-1; /* got 'n' strings to create 1 new */ | 676 | total -= n - 1; /* got 'n' strings to create one new */ |
677 | L->top = top - (n - 1); /* popped 'n' strings and pushed one */ | 677 | L->top -= n - 1; /* popped 'n' strings and pushed one */ |
678 | } while (total > 1); /* repeat until only 1 result left */ | 678 | } while (total > 1); /* repeat until only 1 result left */ |
679 | } | 679 | } |
680 | 680 | ||