diff options
author | Roberto Ierusalimschy <roberto@inf.puc-rio.br> | 2022-05-23 17:50:47 -0300 |
---|---|---|
committer | Roberto Ierusalimschy <roberto@inf.puc-rio.br> | 2022-05-23 17:50:47 -0300 |
commit | 603b2c64add5fbf4b7343525cf109af0c7077695 (patch) | |
tree | 55e8001268a5bfc92b59d3f56f8bb49757c1ff3d | |
parent | 4a00f61276a9a38b0427fbae3dbbd86dfb5a0749 (diff) | |
download | lua-github-603b2c64add5fbf4b7343525cf109af0c7077695.tar.gz |
'luaV_concat' can use invalidated pointer to stack
Bug introduced in commit 42d40581.
-rw-r--r-- | lvm.c | 6 |
1 files changed, 3 insertions, 3 deletions
@@ -643,7 +643,7 @@ void luaV_concat (lua_State *L, int total) { int n = 2; /* number of elements handled in this pass (at least 2) */ if (!(ttisstring(s2v(top - 2)) || cvt2str(s2v(top - 2))) || !tostring(L, s2v(top - 1))) - luaT_tryconcatTM(L); + luaT_tryconcatTM(L); /* may invalidate 'top' */ else if (isemptystr(s2v(top - 1))) /* second operand is empty? */ cast_void(tostring(L, s2v(top - 2))); /* result is first operand */ else if (isemptystr(s2v(top - 2))) { /* first operand is empty string? */ @@ -673,8 +673,8 @@ void luaV_concat (lua_State *L, int total) { } setsvalue2s(L, top - n, ts); /* create result */ } - total -= n-1; /* got 'n' strings to create 1 new */ - L->top = top - (n - 1); /* popped 'n' strings and pushed one */ + total -= n - 1; /* got 'n' strings to create one new */ + L->top -= n - 1; /* popped 'n' strings and pushed one */ } while (total > 1); /* repeat until only 1 result left */ } |