mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-19 18:49:32 +02:00
Code Issues Packages Projects Releases Wiki Activity

lua: Backport fix for CVE-2021-43396

Browse Source 
Backport the fix for CVE-2021-43396 ("C stack overflow with coroutines")
from upstream.

(From OE-Core rev: e74fb3f7a8171cc1293583241a9ef43a515a9320)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Richard Purdie
2021-11-15 11:47:35 +00:00
parent 50e0aed068
commit 26ff8acdc9
2 changed files with 44 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
meta/recipes-devtools/lua/lua/74d99057a5146755e737c479850f87fd0e3b6868.patch Normal file
View File

@@ -0,0 +1,43 @@
From 74d99057a5146755e737c479850f87fd0e3b6868 Mon Sep 17 00:00:00 2001
From: Roberto Ierusalimschy <roberto@inf.puc-rio.br>
Date: Wed, 3 Nov 2021 15:04:18 -0300
Subject: [PATCH] Bug: C stack overflow with coroutines
'coroutine.resume' did not increment counter of C calls when
continuing execution after a protected error (that is,
while running 'precover').
---
ldo.c | 6 ++++--
testes/cstack.lua | 14 ++++++++++++++
2 files changed, 18 insertions(+), 2 deletions(-)
Upstream-Status: Backport [https://github.com/lua/lua/commit/74d99057a5146755e737c479850f87fd0e3b6868.patch]
CVE: CVE-2021-43519
diff --git a/src/ldo.c b/src/ldo.c
index d0edc8b4f..66f890364 100644
--- a/src/ldo.c
+++ b/src/ldo.c
@@ -759,11 +759,10 @@ static void resume (lua_State *L, void *ud) {
StkId firstArg = L->top - n; /* first argument */
CallInfo *ci = L->ci;
if (L->status == LUA_OK) /* starting a coroutine? */
- ccall(L, firstArg - 1, LUA_MULTRET, 1); /* just call its body */
+ ccall(L, firstArg - 1, LUA_MULTRET, 0); /* just call its body */
else { /* resuming from previous yield */
lua_assert(L->status == LUA_YIELD);
L->status = LUA_OK; /* mark that it is running (again) */
- luaE_incCstack(L); /* control the C stack */
if (isLua(ci)) { /* yielded inside a hook? */
L->top = firstArg; /* discard arguments */
luaV_execute(L, ci); /* just continue running Lua code */
@@ -814,6 +813,9 @@ LUA_API int lua_resume (lua_State *L, lua_State *from, int nargs,
else if (L->status != LUA_YIELD) /* ended with errors? */
return resume_error(L, "cannot resume dead coroutine", nargs);
L->nCcalls = (from) ? getCcalls(from) : 0;
+ if (getCcalls(L) >= LUAI_MAXCCALLS)
+ return resume_error(L, "C stack overflow", nargs);
+ L->nCcalls++;
luai_userstateresume(L, nargs);
api_checknelems(L, (L->status == LUA_OK) ? nargs + 1 : nargs);
status = luaD_rawrunprotected(L, resume, &nargs);

1
meta/recipes-devtools/lua/lua_5.4.3.bb
View File

@@ -7,6 +7,7 @@ HOMEPAGE = "http://www.lua.org/"
SRC_URI = "http://www.lua.org/ftp/lua-${PV}.tar.gz;name=tarballsrc \ SRC_URI = "http://www.lua.org/ftp/lua-${PV}.tar.gz;name=tarballsrc \
file://lua.pc.in \ file://lua.pc.in \
${@bb.utils.contains('DISTRO_FEATURES', 'ptest', 'http://www.lua.org/tests/lua-${PV_testsuites}-tests.tar.gz;name=tarballtest file://run-ptest ', '', d)} \ ${@bb.utils.contains('DISTRO_FEATURES', 'ptest', 'http://www.lua.org/tests/lua-${PV_testsuites}-tests.tar.gz;name=tarballtest file://run-ptest ', '', d)} \
file://74d99057a5146755e737c479850f87fd0e3b6868.patch \
" "
# if no test suite matches PV release of Lua exactly, download the suite for the closest Lua release. # if no test suite matches PV release of Lua exactly, download the suite for the closest Lua release.