!17 fix CVE-2021-43519 patch error
From: @tong_1001 Reviewed-by: @xiezhipeng1 Signed-off-by: @xiezhipeng1
This commit is contained in:
commit
b7b0964380
@ -7,41 +7,14 @@ Subject: [PATCH] Bug: C stack overflow with coroutines
|
|||||||
continuing execution after a protected error (that is,
|
continuing execution after a protected error (that is,
|
||||||
while running 'precover').
|
while running 'precover').
|
||||||
---
|
---
|
||||||
src/ldo.c | 6 ++++--
|
lua-5.4.3-tests/cstack.lua | 14 ++++++++++++++
|
||||||
testes/cstack.lua | 14 ++++++++++++++
|
src/ldo.c | 6 ++++--
|
||||||
2 files changed, 18 insertions(+), 2 deletions(-)
|
2 files changed, 18 insertions(+), 2 deletions(-)
|
||||||
|
|
||||||
diff --git a/src/ldo.c b/src/ldo.c
|
diff --git a/lua-5.4.3-tests/cstack.lua b/lua-5.4.3-tests/cstack.lua
|
||||||
index d0edc8b4f..66f890364 100644
|
index 213d15d..ca76c87 100644
|
||||||
--- a/src/ldo.c
|
--- a/lua-5.4.3-tests/cstack.lua
|
||||||
+++ b/src/ldo.c
|
+++ b/lua-5.4.3-tests/cstack.lua
|
||||||
@@ -759,11 +759,10 @@ static void resume (lua_State *L, void *ud) {
|
|
||||||
StkId firstArg = L->top - n; /* first argument */
|
|
||||||
CallInfo *ci = L->ci;
|
|
||||||
if (L->status == LUA_OK) /* starting a coroutine? */
|
|
||||||
- ccall(L, firstArg - 1, LUA_MULTRET, 1); /* just call its body */
|
|
||||||
+ ccall(L, firstArg - 1, LUA_MULTRET, 0); /* just call its body */
|
|
||||||
else { /* resuming from previous yield */
|
|
||||||
lua_assert(L->status == LUA_YIELD);
|
|
||||||
L->status = LUA_OK; /* mark that it is running (again) */
|
|
||||||
- luaE_incCstack(L); /* control the C stack */
|
|
||||||
if (isLua(ci)) { /* yielded inside a hook? */
|
|
||||||
L->top = firstArg; /* discard arguments */
|
|
||||||
luaV_execute(L, ci); /* just continue running Lua code */
|
|
||||||
@@ -814,6 +813,9 @@ LUA_API int lua_resume (lua_State *L, lua_State *from, int nargs,
|
|
||||||
else if (L->status != LUA_YIELD) /* ended with errors? */
|
|
||||||
return resume_error(L, "cannot resume dead coroutine", nargs);
|
|
||||||
L->nCcalls = (from) ? getCcalls(from) : 0;
|
|
||||||
+ if (getCcalls(L) >= LUAI_MAXCCALLS)
|
|
||||||
+ return resume_error(L, "C stack overflow", nargs);
|
|
||||||
+ L->nCcalls++;
|
|
||||||
luai_userstateresume(L, nargs);
|
|
||||||
api_checknelems(L, (L->status == LUA_OK) ? nargs + 1 : nargs);
|
|
||||||
status = luaD_rawrunprotected(L, resume, &nargs);
|
|
||||||
diff --git a/testes/cstack.lua b/testes/cstack.lua
|
|
||||||
index 213d15d47..ca76c8729 100644
|
|
||||||
--- a/testes/cstack.lua
|
|
||||||
+++ b/testes/cstack.lua
|
|
||||||
@@ -103,6 +103,20 @@ do
|
@@ -103,6 +103,20 @@ do
|
||||||
end
|
end
|
||||||
|
|
||||||
@ -63,3 +36,33 @@ index 213d15d47..ca76c8729 100644
|
|||||||
if T then
|
if T then
|
||||||
print("testing stack recovery")
|
print("testing stack recovery")
|
||||||
local N = 0 -- trace number of calls
|
local N = 0 -- trace number of calls
|
||||||
|
diff --git a/src/ldo.c b/src/ldo.c
|
||||||
|
index 7135079..ca558fd 100644
|
||||||
|
--- a/src/ldo.c
|
||||||
|
+++ b/src/ldo.c
|
||||||
|
@@ -728,11 +728,10 @@ static void resume (lua_State *L, void *ud) {
|
||||||
|
StkId firstArg = L->top - n; /* first argument */
|
||||||
|
CallInfo *ci = L->ci;
|
||||||
|
if (L->status == LUA_OK) /* starting a coroutine? */
|
||||||
|
- ccall(L, firstArg - 1, LUA_MULTRET, 1); /* just call its body */
|
||||||
|
+ ccall(L, firstArg - 1, LUA_MULTRET, 0); /* just call its body */
|
||||||
|
else { /* resuming from previous yield */
|
||||||
|
lua_assert(L->status == LUA_YIELD);
|
||||||
|
L->status = LUA_OK; /* mark that it is running (again) */
|
||||||
|
- luaE_incCstack(L); /* control the C stack */
|
||||||
|
if (isLua(ci)) { /* yielded inside a hook? */
|
||||||
|
L->top = firstArg; /* discard arguments */
|
||||||
|
luaV_execute(L, ci); /* just continue running Lua code */
|
||||||
|
@@ -783,6 +782,9 @@ LUA_API int lua_resume (lua_State *L, lua_State *from, int nargs,
|
||||||
|
else if (L->status != LUA_YIELD) /* ended with errors? */
|
||||||
|
return resume_error(L, "cannot resume dead coroutine", nargs);
|
||||||
|
L->nCcalls = (from) ? getCcalls(from) : 0;
|
||||||
|
+ if (getCcalls(L) >= LUAI_MAXCCALLS)
|
||||||
|
+ return resume_error(L, "C stack overflow", nargs);
|
||||||
|
+ L->nCcalls++;
|
||||||
|
luai_userstateresume(L, nargs);
|
||||||
|
api_checknelems(L, (L->status == LUA_OK) ? nargs + 1 : nargs);
|
||||||
|
status = luaD_rawrunprotected(L, resume, &nargs);
|
||||||
|
--
|
||||||
|
1.8.3.1
|
||||||
|
|
||||||
|
|||||||
7
lua.spec
7
lua.spec
@ -6,7 +6,7 @@
|
|||||||
|
|
||||||
Name: lua
|
Name: lua
|
||||||
Version: 5.4.3
|
Version: 5.4.3
|
||||||
Release: 4
|
Release: 5
|
||||||
Summary: A powerful, efficient, lightweight, embeddable scripting language
|
Summary: A powerful, efficient, lightweight, embeddable scripting language
|
||||||
License: MIT
|
License: MIT
|
||||||
URL: http://www.lua.org/
|
URL: http://www.lua.org/
|
||||||
@ -56,6 +56,8 @@ mv src/luaconf.h src/luaconf.h.template.in
|
|||||||
%patch1 -p1 -z .idsize
|
%patch1 -p1 -z .idsize
|
||||||
%patch2 -p1 -z .configure-linux
|
%patch2 -p1 -z .configure-linux
|
||||||
%patch3 -p1 -z .configure-compat-all
|
%patch3 -p1 -z .configure-compat-all
|
||||||
|
%patch6000 -p1
|
||||||
|
|
||||||
# Put proper version in configure.ac, patch0 hardcodes 5.3.0
|
# Put proper version in configure.ac, patch0 hardcodes 5.3.0
|
||||||
sed -i 's|5.3.0|%{version}|g' configure.ac
|
sed -i 's|5.3.0|%{version}|g' configure.ac
|
||||||
autoreconf -ifv
|
autoreconf -ifv
|
||||||
@ -129,6 +131,9 @@ LD_LIBRARY_PATH=$RPM_BUILD_ROOT/%{_libdir} $RPM_BUILD_ROOT/%{_bindir}/lua -e"_U=
|
|||||||
%{_mandir}/man1/lua*.1*
|
%{_mandir}/man1/lua*.1*
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Thu Apr 14 2022 shixuantong <shixuantong@h-partners.com> - 5.4.3-5
|
||||||
|
- fix CVE-2021-43519 patch error
|
||||||
|
|
||||||
* Fri Apr 01 2022 shixuantong <shixuantong@h-partners.com> - 5.4.3-4
|
* Fri Apr 01 2022 shixuantong <shixuantong@h-partners.com> - 5.4.3-4
|
||||||
- fix CVE-2021-43519
|
- fix CVE-2021-43519
|
||||||
|
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user