lua

commit 603b2c64add5fbf4b7343525cf109af0c7077695
parent 4a00f61276a9a38b0427fbae3dbbd86dfb5a0749
Author: Roberto Ierusalimschy <roberto@inf.puc-rio.br>
Date:   Mon, 23 May 2022 17:50:20 -0300

'luaV_concat' can use invalidated pointer to stack

Bug introduced in commit 42d40581.

Diffstat:
M
lvm.c
 | 
6
+++---

1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/lvm.c b/lvm.c
@@ -643,7 +643,7 @@ void luaV_concat (lua_State *L, int total) {
     int n = 2;  /* number of elements handled in this pass (at least 2) */
     if (!(ttisstring(s2v(top - 2)) || cvt2str(s2v(top - 2))) ||
         !tostring(L, s2v(top - 1)))
-      luaT_tryconcatTM(L);
+      luaT_tryconcatTM(L);  /* may invalidate 'top' */
     else if (isemptystr(s2v(top - 1)))  /* second operand is empty? */
       cast_void(tostring(L, s2v(top - 2)));  /* result is first operand */
     else if (isemptystr(s2v(top - 2))) {  /* first operand is empty string? */
@@ -673,8 +673,8 @@ void luaV_concat (lua_State *L, int total) {
       }
       setsvalue2s(L, top - n, ts);  /* create result */
     }
-    total -= n-1;  /* got 'n' strings to create 1 new */
-    L->top = top - (n - 1);  /* popped 'n' strings and pushed one */
+    total -= n - 1;  /* got 'n' strings to create one new */
+    L->top -= n - 1;  /* popped 'n' strings and pushed one */
   } while (total > 1);  /* repeat until only 1 result left */
 }