Re: An heap-use-after-free is triggered in the insertkey()

On 2026-05-21 13:23, Julien Cugnière wrote:
> This disclaimer is well known, but Sergey's example got me thinking:
> does it still apply to "read-only" uses of the debug library?
>
> Of course when using functions such as
> debug.setlocal/setupvalue/setmetatable all bets are off. But in this
> example, only debug.getinfo and debug.sethook are used. Theoretically
> getinfo is a read-only operation (unless it needs to mutate some
> internal state to gather the information?). Setting a hook can be
> considered a modification of the state, but the hook itself is not
> doing anything obviously dangerous. So it feels like such a use of the
> debug library shouldn't be able to crash Lua?
My point of view is that if manual states

"You should exert care when using this library. Several of its functions
[...] can compromise otherwise secure code."

then it's "no warranty" contract clause.

So even if single call of debug.getinfo() along with expected results
will encrypt my data and install rootkit -- no formal complains,
I was warned.

Also I consider posting murky computer-generated code in maillist as not
neat. I believe author is expected to do it's best to represent issue
in minimal essential form for human consumption.

-- Martin

-- 
You received this message because you are subscribed to the Google Groups "lua-l" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/d/msgid/lua-l/128d6ea2-2b97-434b-b8c6-52c875264ea0%40disroot.org.