diff --git a/backport-CVE-2022-28805.patch b/backport-CVE-2022-28805.patch deleted file mode 100644 index 89bc52d..0000000 --- a/backport-CVE-2022-28805.patch +++ /dev/null @@ -1,24 +0,0 @@ -From 1f3c6f4534c6411313361697d98d1145a1f030fa Mon Sep 17 00:00:00 2001 -From: Roberto Ierusalimschy -Date: Tue, 15 Feb 2022 12:28:46 -0300 -Subject: [PATCH] Bug: Lua can generate wrong code when _ENV is - ---- - src/lparser.c | 1 + - 1 files changed, 1 insertions(+) - -diff --git a/src/lparser.c b/src/lparser.c -index 284ef1f..0626833 100644 ---- a/src/lparser.c -+++ b/src/lparser.c -@@ -457,6 +457,7 @@ static void singlevar (LexState *ls, expdesc *var) { - expdesc key; - singlevaraux(fs, ls->envn, var, 1); /* get environment variable */ - lua_assert(var->k != VVOID); /* this one must exist */ -+ luaK_exp2anyregup(fs, var); /* but could be a constant */ - codestring(&key, varname); /* key is variable name */ - luaK_indexed(fs, var, &key); /* env[varname] */ - } --- -1.8.3.1 - diff --git a/backport-CVE-2022-33099.patch b/backport-CVE-2022-33099.patch deleted file mode 100644 index f984cab..0000000 --- a/backport-CVE-2022-33099.patch +++ /dev/null @@ -1,62 +0,0 @@ -From 42d40581dd919fb134c07027ca1ce0844c670daf Mon Sep 17 00:00:00 2001 -From: Roberto Ierusalimschy -Date: Fri, 20 May 2022 13:14:33 -0300 -Subject: [PATCH] Save stack space while handling errors - -Because error handling (luaG_errormsg) uses slots from EXTRA_STACK, -and some errors can recur (e.g., string overflow while creating an -error message in 'luaG_runerror', or a C-stack overflow before calling -the message handler), the code should use stack slots with parsimony. - -This commit fixes the bug "Lua-stack overflow when C stack overflows -while handling an error". ---- - src/ldebug.c | 5 ++++- - src/lvm.c | 6 ++++-- - 2 files changed, 8 insertions(+), 3 deletions(-) - -diff --git a/src/ldebug.c b/src/ldebug.c -index 1feaab2..5524fae 100644 ---- a/src/ldebug.c -+++ b/src/ldebug.c -@@ -783,8 +783,11 @@ l_noret luaG_runerror (lua_State *L, const char *fmt, ...) { - va_start(argp, fmt); - msg = luaO_pushvfstring(L, fmt, argp); /* format message */ - va_end(argp); -- if (isLua(ci)) /* if Lua function, add source:line information */ -+ if (isLua(ci)) { /* if Lua function, add source:line information */ - luaG_addinfo(L, msg, ci_func(ci)->p->source, getcurrentline(ci)); -+ setobjs2s(L, L->top - 2, L->top - 1); /* remove 'msg' from the stack */ -+ L->top--; -+ } - luaG_errormsg(L); - } - -diff --git a/src/lvm.c b/src/lvm.c -index c9729bc..a965087 100644 ---- a/src/lvm.c -+++ b/src/lvm.c -@@ -656,8 +656,10 @@ void luaV_concat (lua_State *L, int total) { - /* collect total length and number of strings */ - for (n = 1; n < total && tostring(L, s2v(top - n - 1)); n++) { - size_t l = vslen(s2v(top - n - 1)); -- if (l_unlikely(l >= (MAX_SIZE/sizeof(char)) - tl)) -+ if (l_unlikely(l >= (MAX_SIZE/sizeof(char)) - tl)) { -+ L->top = top - total; /* pop strings to avoid wasting stack */ - luaG_runerror(L, "string length overflow"); -+ } - tl += l; - } - if (tl <= LUAI_MAXSHORTLEN) { /* is result a short string? */ -@@ -672,7 +674,7 @@ void luaV_concat (lua_State *L, int total) { - setsvalue2s(L, top - n, ts); /* create result */ - } - total -= n-1; /* got 'n' strings to create 1 new */ -- L->top -= n-1; /* popped 'n' strings and pushed one */ -+ L->top = top - (n - 1); /* popped 'n' strings and pushed one */ - } while (total > 1); /* repeat until only 1 result left */ - } - --- -2.33.0 - diff --git a/backport-luaV_concat-can-use-invalidated-pointer-to-stack.patch b/backport-luaV_concat-can-use-invalidated-pointer-to-stack.patch deleted file mode 100644 index beef7e6..0000000 --- a/backport-luaV_concat-can-use-invalidated-pointer-to-stack.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 603b2c64add5fbf4b7343525cf109af0c7077695 Mon Sep 17 00:00:00 2001 -From: Roberto Ierusalimschy -Date: Mon, 23 May 2022 17:50:47 -0300 -Subject: [PATCH] 'luaV_concat' can use invalidated pointer to stack - -Bug introduced in commit 42d40581. ---- - src/lvm.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/src/lvm.c b/src/lvm.c -index cd992aa..614df05 100644 ---- a/src/lvm.c -+++ b/src/lvm.c -@@ -643,7 +643,7 @@ void luaV_concat (lua_State *L, int total) { - int n = 2; /* number of elements handled in this pass (at least 2) */ - if (!(ttisstring(s2v(top - 2)) || cvt2str(s2v(top - 2))) || - !tostring(L, s2v(top - 1))) -- luaT_tryconcatTM(L); -+ luaT_tryconcatTM(L); /* may invalidate 'top' */ - else if (isemptystr(s2v(top - 1))) /* second operand is empty? */ - cast_void(tostring(L, s2v(top - 2))); /* result is first operand */ - else if (isemptystr(s2v(top - 2))) { /* first operand is empty string? */ -@@ -673,8 +673,8 @@ void luaV_concat (lua_State *L, int total) { - } - setsvalue2s(L, top - n, ts); /* create result */ - } -- total -= n-1; /* got 'n' strings to create 1 new */ -- L->top = top - (n - 1); /* popped 'n' strings and pushed one */ -+ total -= n - 1; /* got 'n' strings to create one new */ -+ L->top -= n - 1; /* popped 'n' strings and pushed one */ - } while (total > 1); /* repeat until only 1 result left */ - } - --- -1.8.3.1 - diff --git a/lua-5.3.0-idsize.patch b/lua-5.3.0-idsize.patch deleted file mode 100644 index 16107fe..0000000 --- a/lua-5.3.0-idsize.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -up lua-5.3.0/src/luaconf.h.template.in.idsize lua-5.3.0/src/luaconf.h.template.in ---- lua-5.3.0/src/luaconf.h.template.in.idsize 2015-01-15 10:23:20.515801344 -0500 -+++ lua-5.3.0/src/luaconf.h.template.in 2015-01-15 10:23:48.955651916 -0500 -@@ -693,7 +693,7 @@ - @@ of a function in debug information. - ** CHANGE it if you want a different size. - */ --#define LUA_IDSIZE 60 -+#define LUA_IDSIZE 512 - - - /* diff --git a/lua-5.4.4-tests.tar.gz b/lua-5.4.4-tests.tar.gz deleted file mode 100644 index 31b820b..0000000 Binary files a/lua-5.4.4-tests.tar.gz and /dev/null differ diff --git a/lua-5.4.4.tar.gz b/lua-5.4.4.tar.gz deleted file mode 100644 index f33e458..0000000 Binary files a/lua-5.4.4.tar.gz and /dev/null differ diff --git a/lua-5.4.6-idsize.patch b/lua-5.4.6-idsize.patch new file mode 100644 index 0000000..a97688d --- /dev/null +++ b/lua-5.4.6-idsize.patch @@ -0,0 +1,14 @@ +diff --git a/src/luaconf.h.template.in b/src/luaconf.h.template.in +index 1e32333..601d10e 100644 +--- a/src/luaconf.h.template.in ++++ b/src/luaconf.h.template.in +@@ -762,7 +762,7 @@ + ** of a function in debug information. + ** CHANGE it if you want a different size. + */ +-#define LUA_IDSIZE 60 ++#define LUA_IDSIZE 512 + + + /* + diff --git a/lua-5.4.6-tests.tar.gz b/lua-5.4.6-tests.tar.gz new file mode 100644 index 0000000..8ab6264 Binary files /dev/null and b/lua-5.4.6-tests.tar.gz differ diff --git a/lua-5.4.6.tar.gz b/lua-5.4.6.tar.gz new file mode 100644 index 0000000..5677b16 Binary files /dev/null and b/lua-5.4.6.tar.gz differ diff --git a/lua.spec b/lua.spec index bda0d03..7d5fffc 100644 --- a/lua.spec +++ b/lua.spec @@ -1,11 +1,11 @@ %global major_version 5.4 -# test version is 5.4.4 -%global test_version 5.4.4 +# test version is 5.4.6 +%global test_version 5.4.6 # Place rpm-macros into proper location. %global macrosdir %(d=%{_rpmconfigdir}/macros.d; [ -d $d ] || d=%{_sysconfdir}/rpm; echo $d) Name: lua -Version: 5.4.4 +Version: 5.4.6 Release: 1 Summary: A powerful, efficient, lightweight, embeddable scripting language License: MIT @@ -20,12 +20,9 @@ Source3: mit.txt # rpm-macro Source1000: macros.lua Patch0: lua-5.4.0-beta-autotoolize.patch -Patch1: lua-5.3.0-idsize.patch +Patch1: lua-5.4.6-idsize.patch Patch2: lua-5.2.2-configure-linux.patch Patch3: lua-5.3.0-configure-compat-module.patch -Patch6000: backport-CVE-2022-28805.patch -Patch6001: backport-CVE-2022-33099.patch -Patch6002: backport-luaV_concat-can-use-invalidated-pointer-to-stack.patch BuildRequires: automake autoconf libtool readline-devel ncurses-devel @@ -58,9 +55,6 @@ mv src/luaconf.h src/luaconf.h.template.in %patch1 -p1 -z .idsize %patch2 -p1 -z .configure-linux %patch3 -p1 -z .configure-compat-all -%patch6000 -p1 -%patch6001 -p1 -%patch6002 -p1 # Put proper version in configure.ac, patch0 hardcodes 5.3.0 sed -i 's|5.3.0|%{version}|g' configure.ac @@ -135,6 +129,9 @@ LD_LIBRARY_PATH=$RPM_BUILD_ROOT/%{_libdir} $RPM_BUILD_ROOT/%{_bindir}/lua -e"_U= %{_mandir}/man1/lua*.1* %changelog +* Wed Jun 14 2023 yanglongkang - 5.4.6-1 +- upgrade to version 5.4.6 + * Thu Jan 19 2023 hubin - 5.4.4-1 - upgrade to version 5.4.4