Possible NULL pointer dereference in lua_setlocal (Lua 5.4.6)

Hi,

I was going through the debug API in Lua 5.4.6 and noticed something that might be a bug, or at least an inconsistency.

In ldebug.c, the function lua_getlocal checks whether ar is NULL before using it:

c
if(ar ==NULL){/* handle the NULL case */}

But lua_setlocal right below it doesn't have that check. It just goes ahead and accesses ar->i_ci directly:

c
name =luaG_findlocal(L, ar->i_ci, n,&pos);

So if someone calls lua_setlocal with ar = NULL (which the API allows as far as I can tell, since it's a public function and lua_getlocal already handles it), it'll segfault.

I haven't tested this in a real script yet, but it looks like an oversight. Maybe lua_setlocal should have the same NULL guard as lua_getlocal for consistency.

Quick fix would be adding something like:

c
if(ar ==NULL){lua_unlock(L);returnNULL;}

at the beginning of the function.

Not sure if this is intentional or just a missing check. Figured I'd mention it.

Thanks



-- 
You received this message because you are subscribed to the Google Groups "lua-l" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/d/msgid/lua-l/58144471.341a.19d84cb01dd.Coremail.haozhou_cs%40163.com.