mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-10-23 20:58:33 +00:00
Armin Kuster
aaa6eb0bb5
Source: lua.org MR: 97553 Type: Security Fix Disposition: Backport from http://lua.2524044.n2.nabble.com/CVE-2019-6706-use-after-free-in-lua-upvaluejoin-function-tc7685575.html ChangeID: c939b7edcb54274ab0aeebcb7e3dc9f17cc09c2d Description: Affects < 5.3.5 Fixes: CVE-2019-6706 Signed-off-by: Armin Kuster <akuster808@gmail.com>
33 lines
1.1 KiB
Diff
33 lines
1.1 KiB
Diff
CVE-2019-6706: use-after-free in lua_upvaluejoin function
|
|
|
|
Upstream-Status: Backport
|
|
http://lua.2524044.n2.nabble.com/CVE-2019-6706-use-after-free-in-lua-upvaluejoin-function-tc7685575.html
|
|
CVE: CVE-2019-6706
|
|
Affects < 5.3.5
|
|
Signed-off-by: Armin Kuster <akuster@mvista.com>
|
|
|
|
Index: lua-5.3.4/src/lapi.c
|
|
===================================================================
|
|
--- lua-5.3.4.orig/src/lapi.c
|
|
+++ lua-5.3.4/src/lapi.c
|
|
@@ -1285,14 +1285,14 @@ LUA_API void *lua_upvalueid (lua_State *
|
|
|
|
LUA_API void lua_upvaluejoin (lua_State *L, int fidx1, int n1,
|
|
int fidx2, int n2) {
|
|
- LClosure *f1;
|
|
- UpVal **up1 = getupvalref(L, fidx1, n1, &f1);
|
|
+ UpVal **up1 = getupvalref(L, fidx1, n1, NULL); /* the last parameter not needed */
|
|
UpVal **up2 = getupvalref(L, fidx2, n2, NULL);
|
|
+ if (*up1 == *up2) return; /* Already joined */
|
|
+ (*up2)->refcount++;
|
|
+ if (upisopen(*up2)) (*up2)->u.open.touched = 1;
|
|
+ luaC_upvalbarrier(L, *up2);
|
|
luaC_upvdeccount(L, *up1);
|
|
*up1 = *up2;
|
|
- (*up1)->refcount++;
|
|
- if (upisopen(*up1)) (*up1)->u.open.touched = 1;
|
|
- luaC_upvalbarrier(L, *up1);
|
|
}
|
|
|
|
|