1From 42d40581dd919fb134c07027ca1ce0844c670daf Mon Sep 17 00:00:00 2001 2From: Roberto Ierusalimschy <roberto@inf.puc-rio.br> 3Date: Fri, 20 May 2022 13:14:33 -0300 4Subject: [PATCH] Save stack space while handling errors 5 6Because error handling (luaG_errormsg) uses slots from EXTRA_STACK, 7and some errors can recur (e.g., string overflow while creating an 8error message in 'luaG_runerror', or a C-stack overflow before calling 9the message handler), the code should use stack slots with parsimony. 10 11This commit fixes the bug "Lua-stack overflow when C stack overflows 12while handling an error". 13 14CVE: CVE-2022-33099 15 16Upstream-Status: Backport [https://github.com/lua/lua/commit/42d40581dd919fb134c07027ca1ce0844c670daf] 17 18Signed-off-by: Khem Raj <raj.khem@gmail.com> 19--- 20 ldebug.c | 5 ++++- 21 lvm.c | 6 ++++-- 22 2 files changed, 8 insertions(+), 3 deletions(-) 23 24--- a/src/ldebug.c 25+++ b/src/ldebug.c 26@@ -824,8 +824,11 @@ l_noret luaG_runerror (lua_State *L, con 27 va_start(argp, fmt); 28 msg = luaO_pushvfstring(L, fmt, argp); /* format message */ 29 va_end(argp); 30- if (isLua(ci)) /* if Lua function, add source:line information */ 31+ if (isLua(ci)) { /* if Lua function, add source:line information */ 32 luaG_addinfo(L, msg, ci_func(ci)->p->source, getcurrentline(ci)); 33+ setobjs2s(L, L->top - 2, L->top - 1); /* remove 'msg' from the stack */ 34+ L->top--; 35+ } 36 luaG_errormsg(L); 37 } 38 39--- a/src/lvm.c 40+++ b/src/lvm.c 41@@ -656,8 +656,10 @@ void luaV_concat (lua_State *L, int tota 42 /* collect total length and number of strings */ 43 for (n = 1; n < total && tostring(L, s2v(top - n - 1)); n++) { 44 size_t l = vslen(s2v(top - n - 1)); 45- if (l_unlikely(l >= (MAX_SIZE/sizeof(char)) - tl)) 46+ if (l_unlikely(l >= (MAX_SIZE/sizeof(char)) - tl)) { 47+ L->top = top - total; /* pop strings to avoid wasting stack */ 48 luaG_runerror(L, "string length overflow"); 49+ } 50 tl += l; 51 } 52 if (tl <= LUAI_MAXSHORTLEN) { /* is result a short string? */ 53@@ -672,7 +674,7 @@ void luaV_concat (lua_State *L, int tota 54 setsvalue2s(L, top - n, ts); /* create result */ 55 } 56 total -= n-1; /* got 'n' strings to create 1 new */ 57- L->top -= n-1; /* popped 'n' strings and pushed one */ 58+ L->top = top - (n - 1); /* popped 'n' strings and pushed one */ 59 } while (total > 1); /* repeat until only 1 result left */ 60 } 61 62