tarantool / luajit / 15508613281

70%

tarantool/master: 93%

Build Type

push

github

Committed by Buristan

Commit Message

Rework stack overflow handling.

Reported by pwnhacker0x18. Fixed by Peter Cawley.

(cherry picked from commit defe61a56)

In case of the Lua stack overflow error, LuaJIT restores the `L->top`
value and pushes the error message above. It is possible that the
restored value is greater than `L->maxstack`, so pushing the error
message causes dirty write out-of-bounds.

This patch prevents it by overwriting stack overflow handling machinery.
Now, in the aforementioned case, the last frame is replaced with a dummy
frame to avoid dirty writes. In some cases, there may not be enough
space on the stack to invoke the error handler. See the related changes
in the <test/LuaJIT-tests/lang/stackov.lua>.

Sergey Kaplun:
* added the description and the test for the problem

Part of tarantool/tarantool#11278

Reviewed-by: Sergey Bronnikov <sergeyb@tarantool.org>
Signed-off-by: Sergey Kaplun <skaplun@tarantool.org>
(cherry picked from commit 58dcabe69)

Run Details

5691 of 6026 branches covered (94.44%)

Branch coverage included in aggregate %.

29 of 31 new or added lines in 2 files covered. (93.55%)

7 existing lines in 3 files now uncovered.

21696 of 23414 relevant lines covered (92.66%)

1799133.42 hits per line