mirror of
https://github.com/lua/lua
synced 2024-11-22 04:41:23 +03:00
'luaV_concat' can use invalidated pointer to stack
Bug introduced in commit 42d40581
.
This commit is contained in:
parent
4a00f61276
commit
603b2c64ad
6
lvm.c
6
lvm.c
@ -643,7 +643,7 @@ void luaV_concat (lua_State *L, int total) {
|
||||
int n = 2; /* number of elements handled in this pass (at least 2) */
|
||||
if (!(ttisstring(s2v(top - 2)) || cvt2str(s2v(top - 2))) ||
|
||||
!tostring(L, s2v(top - 1)))
|
||||
luaT_tryconcatTM(L);
|
||||
luaT_tryconcatTM(L); /* may invalidate 'top' */
|
||||
else if (isemptystr(s2v(top - 1))) /* second operand is empty? */
|
||||
cast_void(tostring(L, s2v(top - 2))); /* result is first operand */
|
||||
else if (isemptystr(s2v(top - 2))) { /* first operand is empty string? */
|
||||
@ -673,8 +673,8 @@ void luaV_concat (lua_State *L, int total) {
|
||||
}
|
||||
setsvalue2s(L, top - n, ts); /* create result */
|
||||
}
|
||||
total -= n-1; /* got 'n' strings to create 1 new */
|
||||
L->top = top - (n - 1); /* popped 'n' strings and pushed one */
|
||||
total -= n - 1; /* got 'n' strings to create one new */
|
||||
L->top -= n - 1; /* popped 'n' strings and pushed one */
|
||||
} while (total > 1); /* repeat until only 1 result left */
|
||||
}
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user