tarantool / luajit / 6013780369

88%

tarantool/master: 93%

push

github

Fix predict_next() in parser (again).

Reported by Sergey Bronnikov.

(cherry picked from commit 309fb42b8)

The following Lua snippet triggers out-of-boundary access to a stack:

```
a, b, c = 1, 2, 3
local d
for _ in nil do end
```

With execution snippet by LuaJIT instrumented by ASAN it leads to
a heap-buffer-overflow.

In a function `predict_next()` variable `exprpc` looks forward and
expects extra bytecodes on the stack. However, `KPRI` is merged to the
the `KNIL` and there is no new bytecode to add, so
`exprpc == fs->bclim`, and it leads to out-of-boundary access.
Issue has been fixed by early return when `pc >= fs->bclim`.

Sergey Bronnikov:
* added the description and the test for the problem

Part of tarantool/tarantool#8825

5336 of 5969 branches covered (0.0%)

Branch coverage included in aggregate %.

20473 of 23288 relevant lines covered (87.91%)

1290783.05 hits per line