Re: An heap-use-after-free is triggered in the insertkey()

Hello, Julien,

You're right. I have exactly the same thoughts about the reproducer.
The debug functions here don't perform any destructive actions.
But this leads to the GC freeing the object we later access.

Sergey

On Thursday, May 21, 2026 at 2:24:02 PM UTC+3 Julien Cugnière wrote:

Le jeu. 21 mai 2026 à 12:14, 'Martin Eden' via lua-l 
<[email protected]> a écrit : 
> On 2026-05-21 11:54, Sergey Bronnikov wrote: 
> > Hello, 
> > 
> > an heap-use-after-free is triggered on execution of a Lua chunk below: 
> 
> I expect that using "debug" module voids warranty. 

This disclaimer is well known, but Sergey's example got me thinking: 
does it still apply to "read-only" uses of the debug library? 

Of course when using functions such as 
debug.setlocal/setupvalue/setmetatable all bets are off. But in this 
example, only debug.getinfo and debug.sethook are used. Theoretically 
getinfo is a read-only operation (unless it needs to mutate some 
internal state to gather the information?). Setting a hook can be 
considered a modification of the state, but the hook itself is not 
doing anything obviously dangerous. So it feels like such a use of the 
debug library shouldn't be able to crash Lua? 

-- 
You received this message because you are subscribed to the Google Groups "lua-l" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/d/msgid/lua-l/4af501ae-4905-4279-9b43-bf1a89464e30n%40googlegroups.com.