main/lua5.4/CVE-2022-28805.patch

1
-2
-3
-4
-5
-6
-7
-8
-9
-10
-11
-12
-13
-14
-15
-16
-17
-18
-19
-20
-21
-22
-23
- Patch-Source: https://github.com/lua/lua/commit/1f3c6f4534c6411313361697d98d1145a1f030fa
-From 1f3c6f4534c6411313361697d98d1145a1f030fa Mon Sep 17 00:00:00 2001
-From: Roberto Ierusalimschy <roberto@inf.puc-rio.br>
-Date: Tue, 15 Feb 2022 12:28:46 -0300
-Subject: [PATCH] Bug: Lua can generate wrong code when _ENV is <const>
-
----
- lparser.c         |  1 +
- testes/attrib.lua | 10 ++++++++++
- 2 files changed, 11 insertions(+)
-
-diff --git a/lparser.c b/lparser.c
-index 3abe3d751..a5cd55257 100644
---- a/src/lparser.c
-+++ b/src/lparser.c
-@@ -468,6 +468,7 @@ static void singlevar (LexState *ls, expdesc *var) {
-     expdesc key;
-     singlevaraux(fs, ls->envn, var, 1);  /* get environment variable */
-     lua_assert(var->k != VVOID);  /* this one must exist */
-+    luaK_exp2anyregup(fs, var);  /* but could be a constant */
-     codestring(&key, varname);  /* key is variable name */
-     luaK_indexed(fs, var, &key);  /* env[varname] */
-   }
-
1
-2
-3
-4
-5
-6
-7
-8
-9
-10
-11
-12
-13
-14
-15
-16
-17
-18
-19
-20
-21
-22
-23
- Patch-Source: https://salsa.debian.org/lua-team/lua5.4/-/blob/bc284bb404e51d27feb5ffc705de8e32959c2048/debian/patches/0003-extern_C.patch
-From: Enrico Tassi <gareuselesinge@debian.org>
-Date: Fri, 14 Aug 2015 09:36:52 +0200
-Subject: extern_C
-
----
- src/luaconf.h | 4 ++++
- 1 file changed, 4 insertions(+)
-
---- a/src/luaconf.h
-+++ b/src/luaconf.h
-@@ -287,7 +287,11 @@
- 
- #else				/* }{ */
- 
-+#ifdef __cplusplus
-+#define LUA_API                extern "C"
-+#else
- #define LUA_API		extern
-+#endif
- 
- #endif				/* } */
- 
-
1
-2
-3
-4
-5
-6
-7
-8
-9
-10
-11
-12
-13
-14
-15
-16
-17
-18
-19
-20
-21
-22
-23
-24
-25
-26
-27
-28
-29
-30
-31
-32
-33
-34
-35
-36
-37
-38
-39
-40
-41
-42
-43
-44
-45
-46
-47
-48
-49
-50
-51
-52
-53
-54
-55
-56
- Lua5.4 frees the lineinfo memory twice. Once via combine() and once
-via close_state() this causes a segfault on musl. The segfault double
-free can be fixed by having combine assign NULL to f->lineinfo after
-it has been freed. Thus not freeing it again in close_state().
-
-Valgrind output for the double-free:
-
-	==29903== Invalid free() / delete / delete[] / realloc()
-	==29903==    at 0x48A4B0D: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
-	==29903==    by 0x11E5D2: l_alloc (lauxlib.c:1014)
-	==29903==    by 0x112F51: luaM_free_ (lmem.c:135)
-	==29903==    by 0x11111B: luaF_freeproto (lfunc.c:271)
-	==29903==    by 0x112ABB: deletelist (lgc.c:1494)
-	==29903==    by 0x112ABB: luaC_freeallobjects (lgc.c:1511)
-	==29903==    by 0x116D54: close_state (lstate.c:276)
-	==29903==    by 0x10B549: main (luac.c:210)
-	==29903==  Address 0x48ec220 is 0 bytes inside a block of size 10 free'd
-	==29903==    at 0x48A4B0D: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
-	==29903==    by 0x11E5D2: l_alloc (lauxlib.c:1014)
-	==29903==    by 0x112F51: luaM_free_ (lmem.c:135)
-	==29903==    by 0x10C60C: combine (luac.c:158)
-	==29903==    by 0x10C60C: pmain (luac.c:183)
-	==29903==    by 0x10FF38: precallC (ldo.c:506)
-	==29903==    by 0x11020C: luaD_precall (ldo.c:572)
-	==29903==    by 0x110340: ccall (ldo.c:607)
-	==29903==    by 0x10F7CA: luaD_rawrunprotected (ldo.c:144)
-	==29903==    by 0x110668: luaD_pcall (ldo.c:926)
-	==29903==    by 0x10DB2F: lua_pcallk (lapi.c:1067)
-	==29903==    by 0x10B528: main (luac.c:209)
-	==29903==  Block was alloc'd at
-	==29903==    at 0x48A6FC9: realloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
-	==29903==    by 0x112F7E: luaM_realloc_ (lmem.c:166)
-	==29903==    by 0x112FC5: luaM_saferealloc_ (lmem.c:180)
-	==29903==    by 0x113074: luaM_shrinkvector_ (lmem.c:116)
-	==29903==    by 0x114B02: close_func (lparser.c:764)
-	==29903==    by 0x116B1B: mainfunc (lparser.c:1937)
-	==29903==    by 0x116B1B: luaY_parser (lparser.c:1959)
-	==29903==    by 0x10F718: f_parser (ldo.c:971)
-	==29903==    by 0x10F7CA: luaD_rawrunprotected (ldo.c:144)
-	==29903==    by 0x110668: luaD_pcall (ldo.c:926)
-	==29903==    by 0x11074B: luaD_protectedparser (ldo.c:988)
-	==29903==    by 0x10DC13: lua_load (lapi.c:1097)
-	==29903==    by 0x10C5B1: combine (luac.c:151)
-	==29903==    by 0x10C5B1: pmain (luac.c:183)
-
-diff -upr lua5.4.4.orig/src/luac.c lua-5.4.4/src/luac.c
---- lua5.4.4.orig/src/luac.c	2022-04-14 20:57:01.927447850 +0200
-+++ lua-5.4.4/src/luac.c	2022-04-14 20:57:35.260900910 +0200
-@@ -156,6 +156,7 @@ static const Proto* combine(lua_State* L
-    if (f->p[i]->sizeupvalues>0) f->p[i]->upvalues[0].instack=0;
-   }
-   luaM_freearray(L,f->lineinfo,f->sizelineinfo);
-+  f->lineinfo=NULL;
-   f->sizelineinfo=0;
-   return f;
-  }
-