lua

commit 34affe7a63fc5d842580a9f23616d057e17dfe27
parent a2195644d89812e5b157ce7bac35543e06db05e3
Author: Roberto Ierusalimschy <roberto@inf.puc-rio.br>
Date:   Fri, 17 Jul 2020 14:53:59 -0300

Fixed bug: 'luaD_callnoyield' called twice in a row

In luaD_callnoyield, when there is a possible stack overflow, it
zeros the number of CallInfos to force a check when calling the
function. However, if the "function" is not a function, the code will
raise an error before checking the stack. Then, the error handling calls
luaD_callnoyield again and nCcalls is decremented again, crossing the
stack redzone without raising an error. (This loop can only happens
once, because the error handler must be a function.  But once is enough
to cross the redzone.)

Diffstat:
M
ldo.c
 | 
9
++++-----

1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/ldo.c b/ldo.c
@@ -515,14 +515,13 @@ void luaD_call (lua_State *L, StkId func, int nresults) {
 
 /*
 ** Similar to 'luaD_call', but does not allow yields during the call.
-** If there is a stack overflow, freeing all CI structures will
-** force the subsequent call to invoke 'luaE_extendCI', which then
-** will raise any errors.
 */
 void luaD_callnoyield (lua_State *L, StkId func, int nResults) {
   incXCcalls(L);
-  if (getCcalls(L) <= CSTACKERR)  /* possible stack overflow? */
-    luaE_freeCI(L);
+  if (getCcalls(L) <= CSTACKERR) {  /* possible C stack overflow? */
+    luaE_exitCcall(L);  /* to compensate decrement in next call */
+    luaE_enterCcall(L);  /* check properly */
+  }
   luaD_call(L, func, nResults);
   decXCcalls(L);
 }