'luaV_concat' can use invalidated pointer to stack

Bug introduced in commit 42d40581.
This commit is contained in:
Roberto Ierusalimschy 2022-05-23 17:50:47 -03:00
parent 4a00f61276
commit 603b2c64ad

6
lvm.c
View File

@ -643,7 +643,7 @@ void luaV_concat (lua_State *L, int total) {
int n = 2; /* number of elements handled in this pass (at least 2) */
if (!(ttisstring(s2v(top - 2)) || cvt2str(s2v(top - 2))) ||
!tostring(L, s2v(top - 1)))
luaT_tryconcatTM(L);
luaT_tryconcatTM(L); /* may invalidate 'top' */
else if (isemptystr(s2v(top - 1))) /* second operand is empty? */
cast_void(tostring(L, s2v(top - 2))); /* result is first operand */
else if (isemptystr(s2v(top - 2))) { /* first operand is empty string? */
@ -673,8 +673,8 @@ void luaV_concat (lua_State *L, int total) {
}
setsvalue2s(L, top - n, ts); /* create result */
}
total -= n-1; /* got 'n' strings to create 1 new */
L->top = top - (n - 1); /* popped 'n' strings and pushed one */
total -= n - 1; /* got 'n' strings to create one new */
L->top -= n - 1; /* popped 'n' strings and pushed one */
} while (total > 1); /* repeat until only 1 result left */
}