From 603b2c64add5fbf4b7343525cf109af0c7077695 Mon Sep 17 00:00:00 2001 From: Roberto Ierusalimschy Date: Mon, 23 May 2022 17:50:47 -0300 Subject: 'luaV_concat' can use invalidated pointer to stack Bug introduced in commit 42d40581. --- lvm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lvm.c b/lvm.c index cd992aad..614df055 100644 --- a/lvm.c +++ b/lvm.c @@ -643,7 +643,7 @@ void luaV_concat (lua_State *L, int total) { int n = 2; /* number of elements handled in this pass (at least 2) */ if (!(ttisstring(s2v(top - 2)) || cvt2str(s2v(top - 2))) || !tostring(L, s2v(top - 1))) - luaT_tryconcatTM(L); + luaT_tryconcatTM(L); /* may invalidate 'top' */ else if (isemptystr(s2v(top - 1))) /* second operand is empty? */ cast_void(tostring(L, s2v(top - 2))); /* result is first operand */ else if (isemptystr(s2v(top - 2))) { /* first operand is empty string? */ @@ -673,8 +673,8 @@ void luaV_concat (lua_State *L, int total) { } setsvalue2s(L, top - n, ts); /* create result */ } - total -= n-1; /* got 'n' strings to create 1 new */ - L->top = top - (n - 1); /* popped 'n' strings and pushed one */ + total -= n - 1; /* got 'n' strings to create one new */ + L->top -= n - 1; /* popped 'n' strings and pushed one */ } while (total > 1); /* repeat until only 1 result left */ } -- cgit v1.2.1