tarantool / luajit / 8261174041

71%

tarantool/master: 93%

Build Type

push

github

Committed by Buristan

Commit Message

Handle stack reallocation in debug.setmetatable() and lua_setmetatable().

Thanks to Sergey Kaplun.

(cherry picked from commit 88ed9fdbb)

When we use the aforementioned functions to set a metatable for types
with one shared metatable, we must flush all traces since they are
specialized to base metatables. If we have enabled vmevent handlers,
they invoke a callback on trace flushing. This callback may reallocate
the Lua stack. Thus invalidates the reference to the `TValue *` object
`o` by the given index in the `lua_setmetatable()` and leads to a
heap-use-after-free error.

This patch fixes the behaviour by recalculating the address by the given
index after possible stack reallocation.

Sergey Kaplun:
* added the description and the test for the problem

Part of tarantool/tarantool#9595

Run Details

5658 of 6016 branches covered (94.05%)

Branch coverage included in aggregate %.

1 of 1 new or added line in 1 file covered. (100.0%)

6 existing lines in 3 files now uncovered.

21592 of 23410 relevant lines covered (92.23%)

2816678.35 hits per line