tarantool / luajit / 30472646469

93%

Build Type

push

github

Committed by Buristan

Commit Message

Fix stack overflow relimit handling.

Thanks to Sergey Kaplun.

(cherry picked from commit d2c1327f5)

If the error handler can't fit to the top of the Lua stack, the stack is
resized up to `LJ_STACK_MAXEX + 1 + 2 * LUA_MINSTACK` hoping that
`lj_state_relimitstack()` shrinks it back. In case when another error is
(gently) handled in the error handler (`pcall(error)` or failed
`load()`) the stack is shrunk to `LJ_STACK_MAX` leaving the rest of the
handler to be executed on the clipped stack, which leads to the
heap-overflow or a crash.

This patch fixes the issue by hardening the relimiting border to match
the extra space allocated before the stack overflow. Also, it fixes some
typos in the comments.

Sergey Kaplun:
* added the description and the test for the problem

Part of tarantool/tarantool#12880

Reviewed-by: Evgeniy Temirgaleev <e.temirgaleev@tarantool.org>
Reviewed-by: Sergey Bronnikov <sergeyb@tarantool.org>
Signed-off-by: Sergey Kaplun <skaplun@tarantool.org>

Coverage Stats

5741 of 6059 branches covered (94.75%)

Branch coverage included in aggregate %.

3 of 3 new or added lines in 1 file covered. (100.0%)

2 existing lines in 2 files now uncovered.

21918 of 23557 relevant lines covered (93.04%)

3970606.12 hits per line