diff options
| author |   Richard Purdie <richard.purdie@linuxfoundation.org> | 2021-11-15 11:47:35 +0000 |
|---|---|---|
| committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2021-11-16 22:19:47 +0000 |
| commit | e74fb3f7a8171cc1293583241a9ef43a515a9320 (patch) | |
| tree | e78b7cb47dc044f5ca205b09683a993e736d4e4c /meta/recipes-devtools/lua | |
| parent | 19753e7fff81a4252d0095b54d37d52db11e3f56 (diff) | |
| download | openembedded-core-e74fb3f7a8171cc1293583241a9ef43a515a9320.tar.gz | |
lua: Backport fix for CVE-2021-43396
Backport the fix for CVE-2021-43396 ("C stack overflow with coroutines")
from upstream.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-devtools/lua')
| -rw-r--r-- | meta/recipes-devtools/lua/lua/74d99057a5146755e737c479850f87fd0e3b6868.patch | 43 | ||||
| -rw-r--r-- | meta/recipes-devtools/lua/lua_5.4.3.bb | 1 |
2 files changed, 44 insertions, 0 deletions
diff --git a/meta/recipes-devtools/lua/lua/74d99057a5146755e737c479850f87fd0e3b6868.patch b/meta/recipes-devtools/lua/lua/74d99057a5146755e737c479850f87fd0e3b6868.patch new file mode 100644 index 0000000000..dcdc04837d --- /dev/null +++ b/meta/recipes-devtools/lua/lua/74d99057a5146755e737c479850f87fd0e3b6868.patch @@ -0,0 +1,43 @@ +From 74d99057a5146755e737c479850f87fd0e3b6868 Mon Sep 17 00:00:00 2001 +From: Roberto Ierusalimschy <roberto@inf.puc-rio.br> +Date: Wed, 3 Nov 2021 15:04:18 -0300 +Subject: [PATCH] Bug: C stack overflow with coroutines + +'coroutine.resume' did not increment counter of C calls when +continuing execution after a protected error (that is, +while running 'precover'). +--- + ldo.c | 6 ++++-- + testes/cstack.lua | 14 ++++++++++++++ + 2 files changed, 18 insertions(+), 2 deletions(-) + +Upstream-Status: Backport [https://github.com/lua/lua/commit/74d99057a5146755e737c479850f87fd0e3b6868.patch] +CVE: CVE-2021-43519 + +diff --git a/src/ldo.c b/src/ldo.c +index d0edc8b4f..66f890364 100644 +--- a/src/ldo.c ++++ b/src/ldo.c +@@ -759,11 +759,10 @@ static void resume (lua_State *L, void *ud) { + StkId firstArg = L->top - n; /* first argument */ + CallInfo *ci = L->ci; + if (L->status == LUA_OK) /* starting a coroutine? */ +- ccall(L, firstArg - 1, LUA_MULTRET, 1); /* just call its body */ ++ ccall(L, firstArg - 1, LUA_MULTRET, 0); /* just call its body */ + else { /* resuming from previous yield */ + lua_assert(L->status == LUA_YIELD); + L->status = LUA_OK; /* mark that it is running (again) */ +- luaE_incCstack(L); /* control the C stack */ + if (isLua(ci)) { /* yielded inside a hook? */ + L->top = firstArg; /* discard arguments */ + luaV_execute(L, ci); /* just continue running Lua code */ +@@ -814,6 +813,9 @@ LUA_API int lua_resume (lua_State *L, lua_State *from, int nargs, + else if (L->status != LUA_YIELD) /* ended with errors? */ + return resume_error(L, "cannot resume dead coroutine", nargs); + L->nCcalls = (from) ? getCcalls(from) : 0; ++ if (getCcalls(L) >= LUAI_MAXCCALLS) ++ return resume_error(L, "C stack overflow", nargs); ++ L->nCcalls++; + luai_userstateresume(L, nargs); + api_checknelems(L, (L->status == LUA_OK) ? nargs + 1 : nargs); + status = luaD_rawrunprotected(L, resume, &nargs); diff --git a/meta/recipes-devtools/lua/lua_5.4.3.bb b/meta/recipes-devtools/lua/lua_5.4.3.bb index 0224744fe7..a204242bc0 100644 --- a/meta/recipes-devtools/lua/lua_5.4.3.bb +++ b/meta/recipes-devtools/lua/lua_5.4.3.bb @@ -7,6 +7,7 @@ HOMEPAGE = "http://www.lua.org/" SRC_URI = "http://www.lua.org/ftp/lua-${PV}.tar.gz;name=tarballsrc \ file://lua.pc.in \ ${@bb.utils.contains('DISTRO_FEATURES', 'ptest', 'http://www.lua.org/tests/lua-${PV_testsuites}-tests.tar.gz;name=tarballtest file://run-ptest ', '', d)} \ + file://74d99057a5146755e737c479850f87fd0e3b6868.patch \ " # if no test suite matches PV release of Lua exactly, download the suite for the closest Lua release. |