tarantool / luajit / 8534322102

71%

tarantool/master: 93%

Build Type

push

github

Committed by Buristan

Commit Message

Handle stack reallocation in debug.setmetatable() and lua_setmetatable().

Thanks to Sergey Kaplun.

(cherry picked from commit 88ed9fdbb)

When we use the aforementioned functions to set a metatable for types
with one shared metatable, we must flush all traces since they are
specialized to base metatables. If we have enabled vmevent handlers,
they invoke a callback on trace flushing. This callback may reallocate
the Lua stack. Thus invalidates the reference to the `TValue *` object
`o` by the given index in the `lua_setmetatable()` and leads to a
heap-use-after-free error.

This patch fixes the behaviour by recalculating the address by the given
index after possible stack reallocation.

Sergey Kaplun:
* added the description and the test for the problem

Part of tarantool/tarantool#9595

Run Details

5661 of 6018 branches covered (94.07%)

Branch coverage included in aggregate %.

1 of 1 new or added line in 1 file covered. (100.0%)

2 existing lines in 2 files now uncovered.

21603 of 23417 relevant lines covered (92.25%)

2820260.22 hits per line