38 lines
1.4 KiB
Diff
38 lines
1.4 KiB
Diff
From 603b2c64add5fbf4b7343525cf109af0c7077695 Mon Sep 17 00:00:00 2001
|
|
From: Roberto Ierusalimschy <roberto@inf.puc-rio.br>
|
|
Date: Mon, 23 May 2022 17:50:47 -0300
|
|
Subject: [PATCH] 'luaV_concat' can use invalidated pointer to stack
|
|
|
|
Bug introduced in commit 42d40581.
|
|
---
|
|
src/lvm.c | 6 +++---
|
|
1 file changed, 3 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/src/lvm.c b/src/lvm.c
|
|
index cd992aa..614df05 100644
|
|
--- a/src/lvm.c
|
|
+++ b/src/lvm.c
|
|
@@ -643,7 +643,7 @@ void luaV_concat (lua_State *L, int total) {
|
|
int n = 2; /* number of elements handled in this pass (at least 2) */
|
|
if (!(ttisstring(s2v(top - 2)) || cvt2str(s2v(top - 2))) ||
|
|
!tostring(L, s2v(top - 1)))
|
|
- luaT_tryconcatTM(L);
|
|
+ luaT_tryconcatTM(L); /* may invalidate 'top' */
|
|
else if (isemptystr(s2v(top - 1))) /* second operand is empty? */
|
|
cast_void(tostring(L, s2v(top - 2))); /* result is first operand */
|
|
else if (isemptystr(s2v(top - 2))) { /* first operand is empty string? */
|
|
@@ -673,8 +673,8 @@ void luaV_concat (lua_State *L, int total) {
|
|
}
|
|
setsvalue2s(L, top - n, ts); /* create result */
|
|
}
|
|
- total -= n-1; /* got 'n' strings to create 1 new */
|
|
- L->top = top - (n - 1); /* popped 'n' strings and pushed one */
|
|
+ total -= n - 1; /* got 'n' strings to create one new */
|
|
+ L->top -= n - 1; /* popped 'n' strings and pushed one */
|
|
} while (total > 1); /* repeat until only 1 result left */
|
|
}
|
|
|
|
--
|
|
1.8.3.1
|
|
|