SOURCES/lua-5-3.4-upvaluejoin.patch

@@ -0,0 +1,11 @@
+--- lua-5.3.4/src/lapi.c.orig	2019-06-03 17:29:46.376205064 +0200
++++ lua-5.3.4/src/lapi.c	2019-06-03 17:31:08.869905663 +0200
+@@ -1289,6 +1289,8 @@
+   LClosure *f1;
+   UpVal **up1 = getupvalref(L, fidx1, n1, &f1);
+   UpVal **up2 = getupvalref(L, fidx2, n2, NULL);
++  if (*up1 == *up2)
++    return;
+   luaC_upvdeccount(L, *up1);
+   *up1 = *up2;
+   (*up1)->refcount++;

SOURCES/lua-5.4.1-bug11.patch

@@ -0,0 +1,30 @@
+From a585eae6e7ada1ca9271607a4f48dfb17868ab7b Mon Sep 17 00:00:00 2001
+From: Roberto Ierusalimschy <roberto@inf.puc-rio.br>
+Date: Mon, 27 Jul 2020 12:01:38 -0300
+Subject: [PATCH] Fixed bug: Negation overflow in getlocal/setlocal
+
+Adjusted for 5.3
+
+---
+diff --git a/src/ldebug.c b/src/ldebug.c
+index f1835890..a44e5439 100644
+--- a/src/ldebug.c
++++ b/src/ldebug.c
+@@ -133,7 +133,7 @@ static const char *upvalname (Proto *p, int uv) {
+ 
+ static const char *findvararg (CallInfo *ci, int n, StkId *pos) {
+   int nparams = clLvalue(ci->func)->p->numparams;
+-  if (n >= cast_int(ci->u.l.base - ci->func) - nparams)
++  if (n < cast_int(ci->u.l.base - ci->func) - nparams) /* 'n' is negative */
+     return NULL;  /* no such vararg */
+   else {
+     *pos = ci->func + nparams + n;
+@@ -148,7 +148,7 @@ static const char *findlocal (lua_State *L, CallInfo *ci, int n,
+   StkId base;
+   if (isLua(ci)) {
+     if (n < 0)  /* access to vararg values? */
+-      return findvararg(ci, -n, pos);
++      return findvararg(ci, n, pos);
+     else {
+       base = ci->u.l.base;
+       name = luaF_getlocalname(ci_func(ci)->p, n, currentpc(ci));

SPECS/lua.spec

@@ -12,7 +12,7 @@
 
 Name:           lua
 Version:        %{major_version}.4
-Release:        10%{?dist}
+Release:        12%{?dist}
 Summary:        Powerful light-weight programming language
 Group:          Development/Languages
 License:        MIT
@@ -44,6 +44,8 @@ Patch9:         lua-5.3.4-bug1.patch
 Patch10:        lua-5.3.4-bug4.patch
 Patch11:        lua-5.3.4-bug5.patch
 Patch12:        lua-5.3.4-bug6.patch
+Patch13:	lua-5-3.4-upvaluejoin.patch
+Patch14:	lua-5.4.1-bug11.patch
 
 BuildRequires:  automake autoconf libtool readline-devel ncurses-devel
 Requires:       lua-libs = %{version}-%{release}
@@ -100,6 +102,8 @@ mv src/luaconf.h src/luaconf.h.template.in
 %patch10 -p1 -b .bug4
 %patch11 -p1 -b .bug5
 %patch12 -p1 -b .bug6
+%patch13 -p1 -b .upvaluejoin
+%patch14 -p1 -b .bug11
 # Put proper version in configure.ac, patch0 hardcodes 5.3.0
 sed -i 's|5.3.0|%{version}|g' configure.ac
 autoreconf -ifv
@@ -222,6 +226,12 @@ install -Dpm 0644 %{SOURCE1000} $RPM_BUILD_ROOT/%{macrosdir}/macros.lua
 
 
 %changelog
+* Mon Aug 02 2019 Florian Festi <ffesti@redhat.com> - 5.3.4-12
+- Fix segfault in getlocal and setlocal (#1880445)
+
+* Mon Jun 03 2019 Florian Festi <ffesti@redhat.com> - 5.3.4-11
+- Fix use after free in lua_upvaluejoin (#1670167)
+
 * Tue Feb 13 2018 Tom Callaway <spot@fedoraproject.org> - 5.3.4-10
 - move lua(abi) provide to -libs
 - add fix for bug 6