lua/lua-5.4.2-CVE-2022-33099.patch

41 lines
1.8 KiB
Diff

diff -up lua-5.4.2/src/ldebug.c.xyz lua-5.4.2/src/ldebug.c
--- lua-5.4.2/src/ldebug.c.xyz 2022-10-11 16:02:25.015408150 +0300
+++ lua-5.4.2/src/ldebug.c 2022-10-11 16:03:10.455804559 +0300
@@ -772,8 +772,11 @@ l_noret luaG_runerror (lua_State *L, con
va_start(argp, fmt);
msg = luaO_pushvfstring(L, fmt, argp); /* format message */
va_end(argp);
- if (isLua(ci)) /* if Lua function, add source:line information */
+ if (isLua(ci)) { /* if Lua function, add source:line information */
luaG_addinfo(L, msg, ci_func(ci)->p->source, getcurrentline(ci));
+ setobjs2s(L, L->top - 2, L->top - 1); /* remove 'msg' from the stack */
+ L->top--;
+ }
luaG_errormsg(L);
}
diff -up lua-5.4.2/src/lvm.c.xyz lua-5.4.2/src/lvm.c
--- lua-5.4.2/src/lvm.c.xyz 2022-10-11 16:02:32.614474444 +0300
+++ lua-5.4.2/src/lvm.c 2022-10-11 16:04:32.063516541 +0300
@@ -654,8 +654,10 @@ void luaV_concat (lua_State *L, int tota
/* collect total length and number of strings */
for (n = 1; n < total && tostring(L, s2v(top - n - 1)); n++) {
size_t l = vslen(s2v(top - n - 1));
- if (unlikely(l >= (MAX_SIZE/sizeof(char)) - tl))
+ if (unlikely(l >= (MAX_SIZE/sizeof(char)) - tl)) {
+ L->top = top - total; /* pop strings to avoid wasting stack */
luaG_runerror(L, "string length overflow");
+ }
tl += l;
}
if (tl <= LUAI_MAXSHORTLEN) { /* is result a short string? */
@@ -670,7 +672,7 @@ void luaV_concat (lua_State *L, int tota
setsvalue2s(L, top - n, ts); /* create result */
}
total -= n-1; /* got 'n' strings to create 1 new */
- L->top -= n-1; /* popped 'n' strings and pushed one */
+ L->top = top - (n - 1); /* popped 'n' strings and pushed one */
} while (total > 1); /* repeat until only 1 result left */
}