Re: An heap-use-after-free is triggered in the insertkey()

--000000000000a5c5bc065667a075
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Roberto Ierusalimschy <[email protected]>=E4=BA=8E2026=E5=B9=B47=E6=9C=
=8811=E6=97=A5 =E5=91=A8=E5=85=AD00:19=E5=86=99=E9=81=93=EF=BC=9A

>
> When it goes to insert key "fo_nt" into the 'parent' table, there is a
> collision with "__newindex", and that previous entry (with the table
> being updated) is moved to another place. Then, luaV_finishset proceeds
> to check the barrier of the table (through 'luaV_finishfastset'), but
> then the value 't' (which pointed to the "__newindex" entry) has already
> another value, and so the barrier isn't called correctly, and so in the
> next GC that new table (which now lives in parent.fo_nt) gets



Interesting bug.

I guess we should call  luaC_barrierback() directly here instead of
luaV_finishfastset(), and call  gcvalue(t) before luaV_fastset()

--=20
You received this message because you are subscribed to the Google Groups "=
lua-l" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to [email protected].
To view this discussion visit https://groups.google.com/d/msgid/lua-l/CAJnY=
Mr0EYJMZ%3DhO2XWG%3DwxCnn91s5cBsPVLP-J9vhGFAtUjjkA%40mail.gmail.com.

--000000000000a5c5bc065667a075
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div><br></div><div><br clear=3D"all"><br clear=3D"all"><div><div dir=3D"lt=
r" class=3D"gmail_signature" data-smartmail=3D"gmail_signature">Roberto Ier=
usalimschy &lt;<a href=3D"mailto:[email protected]">[email protected]=
o.br</a>&gt;=E4=BA=8E2026=E5=B9=B47=E6=9C=8811=E6=97=A5 =E5=91=A8=E5=85=AD0=
0:19=E5=86=99=E9=81=93=EF=BC=9A<br></div></div></div><div><div class=3D"gma=
il_quote gmail_quote_container"><blockquote class=3D"gmail_quote" style=3D"=
margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-lef=
t:1ex" dir=3D"auto"><br>
When it goes to insert key &quot;fo_nt&quot; into the &#39;parent&#39; tabl=
e, there is a<br>
collision with &quot;__newindex&quot;, and that previous entry (with the ta=
ble<br>
being updated) is moved to another place. Then, luaV_finishset proceeds<br>
to check the barrier of the table (through &#39;luaV_finishfastset&#39;), b=
ut<br>
then the value &#39;t&#39; (which pointed to the &quot;__newindex&quot; ent=
ry) has already<br>
another value, and so the barrier isn&#39;t called correctly, and so in the=
<br>
next GC that new table (which now lives in parent.fo_nt) gets</blockquote><=
div dir=3D"auto"><br></div><div dir=3D"auto"><br></div><div dir=3D"auto"><d=
iv style=3D"font-size:inherit" dir=3D"auto">Interesting bug.</div><div styl=
e=3D"font-size:inherit" dir=3D"auto"><br></div><div style=3D"font-size:inhe=
rit" dir=3D"auto">I guess we should call =C2=A0l<span style=3D"font-size:in=
herit">uaC_barrierback() directly here instead of luaV_finishfastset(), and=
 call =C2=A0</span><span style=3D"font-size:inherit">gcvalue(t) before l</s=
pan><span style=3D"font-size:inherit">uaV_fastset()</span></div><div style=
=3D"font-size:inherit" dir=3D"auto"><br></div><div style=3D"font-size:inher=
it" dir=3D"auto"><span style=3D"font-size:inherit"><br></span></div><div st=
yle=3D"font-size:inherit" dir=3D"auto"><span style=3D"font-size:inherit"><b=
r></span></div></div><blockquote class=3D"gmail_quote" style=3D"margin:0px =
0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" dir=
=3D"auto"></blockquote></div></div>

<p></p>

-- <br />
You received this message because you are subscribed to the Google Groups &=
quot;lua-l&quot; group.<br />
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:[email protected]">lua-l+unsubsc=
[email protected]</a>.<br />
To view this discussion visit <a href=3D"https://groups.google.com/d/msgid/=
lua-l/CAJnYMr0EYJMZ%3DhO2XWG%3DwxCnn91s5cBsPVLP-J9vhGFAtUjjkA%40mail.gmail.=
com?utm_medium=3Demail&utm_source=3Dfooter">https://groups.google.com/d/msg=
id/lua-l/CAJnYMr0EYJMZ%3DhO2XWG%3DwxCnn91s5cBsPVLP-J9vhGFAtUjjkA%40mail.gma=
il.com</a>.<br />

--000000000000a5c5bc065667a075--