diff options
author | Mike Pall <mike> | 2024-07-03 21:42:21 +0200 |
---|---|---|
committer | Mike Pall <mike> | 2024-07-03 21:42:21 +0200 |
commit | 811c5322c8ab6bdbb6784cd43aa57041a1cc9360 (patch) | |
tree | 44cd97a1d4dd20d5466cf0cb2e1ad4cb19a7a162 | |
parent | 4a22050df9e76a28ef904382e4b4c69578973cd5 (diff) | |
download | luajit-811c5322c8ab6bdbb6784cd43aa57041a1cc9360.tar.gz luajit-811c5322c8ab6bdbb6784cd43aa57041a1cc9360.tar.bz2 luajit-811c5322c8ab6bdbb6784cd43aa57041a1cc9360.zip |
Handle partial snapshot restore due to stack overflow.
Reported by pwnhacker0x18. Fixed by Peter Cawley. #1196
-rw-r--r-- | src/lj_debug.c | 9 | ||||
-rw-r--r-- | src/lj_trace.c | 4 |
2 files changed, 9 insertions, 4 deletions
diff --git a/src/lj_debug.c b/src/lj_debug.c index bca1d7a5..abb7572c 100644 --- a/src/lj_debug.c +++ b/src/lj_debug.c | |||
@@ -102,9 +102,12 @@ static BCPos debug_framepc(lua_State *L, GCfunc *fn, cTValue *nextframe) | |||
102 | pos = proto_bcpos(pt, ins) - 1; | 102 | pos = proto_bcpos(pt, ins) - 1; |
103 | #if LJ_HASJIT | 103 | #if LJ_HASJIT |
104 | if (pos > pt->sizebc) { /* Undo the effects of lj_trace_exit for JLOOP. */ | 104 | if (pos > pt->sizebc) { /* Undo the effects of lj_trace_exit for JLOOP. */ |
105 | GCtrace *T = (GCtrace *)((char *)(ins-1) - offsetof(GCtrace, startins)); | 105 | if (bc_isret(bc_op(ins[-1]))) { |
106 | lua_assert(bc_isret(bc_op(ins[-1]))); | 106 | GCtrace *T = (GCtrace *)((char *)(ins-1) - offsetof(GCtrace, startins)); |
107 | pos = proto_bcpos(pt, mref(T->startpc, const BCIns)); | 107 | pos = proto_bcpos(pt, mref(T->startpc, const BCIns)); |
108 | } else { | ||
109 | pos = NO_BCPOS; /* Punt in case of stack overflow. */ | ||
110 | } | ||
108 | } | 111 | } |
109 | #endif | 112 | #endif |
110 | return pos; | 113 | return pos; |
diff --git a/src/lj_trace.c b/src/lj_trace.c index d015f2ab..8385f3d1 100644 --- a/src/lj_trace.c +++ b/src/lj_trace.c | |||
@@ -788,8 +788,10 @@ int LJ_FASTCALL lj_trace_exit(jit_State *J, void *exptr) | |||
788 | exd.J = J; | 788 | exd.J = J; |
789 | exd.exptr = exptr; | 789 | exd.exptr = exptr; |
790 | errcode = lj_vm_cpcall(L, NULL, &exd, trace_exit_cp); | 790 | errcode = lj_vm_cpcall(L, NULL, &exd, trace_exit_cp); |
791 | if (errcode) | 791 | if (errcode) { |
792 | setcframe_pc(cframe_raw(L->cframe), L); /* Point to any valid memory. */ | ||
792 | return -errcode; /* Return negated error code. */ | 793 | return -errcode; /* Return negated error code. */ |
794 | } | ||
793 | 795 | ||
794 | lj_vmevent_send(L, TEXIT, | 796 | lj_vmevent_send(L, TEXIT, |
795 | lj_state_checkstack(L, 4+RID_NUM_GPR+RID_NUM_FPR+LUA_MINSTACK); | 797 | lj_state_checkstack(L, 4+RID_NUM_GPR+RID_NUM_FPR+LUA_MINSTACK); |