main/lua5.4/CVE-2022-28805.patch

1
+2
+3
+4
+5
+6
+7
+8
+9
+10
+11
+12
+13
+14
+15
+16
+17
+18
+19
+20
+21
+22
+23
+ Patch-Source: https://github.com/lua/lua/commit/1f3c6f4534c6411313361697d98d1145a1f030fa
+From 1f3c6f4534c6411313361697d98d1145a1f030fa Mon Sep 17 00:00:00 2001
+From: Roberto Ierusalimschy <roberto@inf.puc-rio.br>
+Date: Tue, 15 Feb 2022 12:28:46 -0300
+Subject: [PATCH] Bug: Lua can generate wrong code when _ENV is <const>
+
+---
+ lparser.c         |  1 +
+ testes/attrib.lua | 10 ++++++++++
+ 2 files changed, 11 insertions(+)
+
+diff --git a/lparser.c b/lparser.c
+index 3abe3d751..a5cd55257 100644
+--- a/src/lparser.c
++++ b/src/lparser.c
+@@ -468,6 +468,7 @@ static void singlevar (LexState *ls, expdesc *var) {
+     expdesc key;
+     singlevaraux(fs, ls->envn, var, 1);  /* get environment variable */
+     lua_assert(var->k != VVOID);  /* this one must exist */
++    luaK_exp2anyregup(fs, var);  /* but could be a constant */
+     codestring(&key, varname);  /* key is variable name */
+     luaK_indexed(fs, var, &key);  /* env[varname] */
+   }
+
1
+2
+3
+4
+5
+6
+7
+8
+9
+10
+11
+12
+13
+14
+15
+16
+17
+18
+19
+20
+21
+22
+23
+ Patch-Source: https://salsa.debian.org/lua-team/lua5.4/-/blob/bc284bb404e51d27feb5ffc705de8e32959c2048/debian/patches/0003-extern_C.patch
+From: Enrico Tassi <gareuselesinge@debian.org>
+Date: Fri, 14 Aug 2015 09:36:52 +0200
+Subject: extern_C
+
+---
+ src/luaconf.h | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/src/luaconf.h
++++ b/src/luaconf.h
+@@ -287,7 +287,11 @@
+ 
+ #else				/* }{ */
+ 
++#ifdef __cplusplus
++#define LUA_API                extern "C"
++#else
+ #define LUA_API		extern
++#endif
+ 
+ #endif				/* } */
+ 
+
1
+2
+3
+4
+5
+6
+7
+8
+9
+10
+11
+12
+13
+14
+15
+16
+17
+18
+19
+20
+21
+22
+23
+24
+25
+26
+27
+28
+29
+30
+31
+32
+33
+34
+35
+36
+37
+38
+39
+40
+41
+42
+43
+44
+45
+46
+47
+48
+49
+50
+51
+52
+53
+54
+55
+56
+ Lua5.4 frees the lineinfo memory twice. Once via combine() and once
+via close_state() this causes a segfault on musl. The segfault double
+free can be fixed by having combine assign NULL to f->lineinfo after
+it has been freed. Thus not freeing it again in close_state().
+
+Valgrind output for the double-free:
+
+	==29903== Invalid free() / delete / delete[] / realloc()
+	==29903==    at 0x48A4B0D: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
+	==29903==    by 0x11E5D2: l_alloc (lauxlib.c:1014)
+	==29903==    by 0x112F51: luaM_free_ (lmem.c:135)
+	==29903==    by 0x11111B: luaF_freeproto (lfunc.c:271)
+	==29903==    by 0x112ABB: deletelist (lgc.c:1494)
+	==29903==    by 0x112ABB: luaC_freeallobjects (lgc.c:1511)
+	==29903==    by 0x116D54: close_state (lstate.c:276)
+	==29903==    by 0x10B549: main (luac.c:210)
+	==29903==  Address 0x48ec220 is 0 bytes inside a block of size 10 free'd
+	==29903==    at 0x48A4B0D: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
+	==29903==    by 0x11E5D2: l_alloc (lauxlib.c:1014)
+	==29903==    by 0x112F51: luaM_free_ (lmem.c:135)
+	==29903==    by 0x10C60C: combine (luac.c:158)
+	==29903==    by 0x10C60C: pmain (luac.c:183)
+	==29903==    by 0x10FF38: precallC (ldo.c:506)
+	==29903==    by 0x11020C: luaD_precall (ldo.c:572)
+	==29903==    by 0x110340: ccall (ldo.c:607)
+	==29903==    by 0x10F7CA: luaD_rawrunprotected (ldo.c:144)
+	==29903==    by 0x110668: luaD_pcall (ldo.c:926)
+	==29903==    by 0x10DB2F: lua_pcallk (lapi.c:1067)
+	==29903==    by 0x10B528: main (luac.c:209)
+	==29903==  Block was alloc'd at
+	==29903==    at 0x48A6FC9: realloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
+	==29903==    by 0x112F7E: luaM_realloc_ (lmem.c:166)
+	==29903==    by 0x112FC5: luaM_saferealloc_ (lmem.c:180)
+	==29903==    by 0x113074: luaM_shrinkvector_ (lmem.c:116)
+	==29903==    by 0x114B02: close_func (lparser.c:764)
+	==29903==    by 0x116B1B: mainfunc (lparser.c:1937)
+	==29903==    by 0x116B1B: luaY_parser (lparser.c:1959)
+	==29903==    by 0x10F718: f_parser (ldo.c:971)
+	==29903==    by 0x10F7CA: luaD_rawrunprotected (ldo.c:144)
+	==29903==    by 0x110668: luaD_pcall (ldo.c:926)
+	==29903==    by 0x11074B: luaD_protectedparser (ldo.c:988)
+	==29903==    by 0x10DC13: lua_load (lapi.c:1097)
+	==29903==    by 0x10C5B1: combine (luac.c:151)
+	==29903==    by 0x10C5B1: pmain (luac.c:183)
+
+diff -upr lua5.4.4.orig/src/luac.c lua-5.4.4/src/luac.c
+--- lua5.4.4.orig/src/luac.c	2022-04-14 20:57:01.927447850 +0200
++++ lua-5.4.4/src/luac.c	2022-04-14 20:57:35.260900910 +0200
+@@ -156,6 +156,7 @@ static const Proto* combine(lua_State* L
+    if (f->p[i]->sizeupvalues>0) f->p[i]->upvalues[0].instack=0;
+   }
+   luaM_freearray(L,f->lineinfo,f->sizelineinfo);
++  f->lineinfo=NULL;
+   f->sizelineinfo=0;
+   return f;
+  }
+