From e0260eb2d4085723302d637dd8f3fca339d18817 Mon Sep 17 00:00:00 2001 From: Roberto Ierusalimschy Date: Thu, 25 Feb 2021 13:39:36 -0300 Subject: [PATCH] Bug (kind of) in 'isinstack' The function 'isinstack' tried to work around the undefined behavior of subtracting two pointers that do not point to the same object, but the compiler killed to trick. (It optimizes out the safety check, because in a correct execution it will be always true.) --- ldebug.c | 16 ++++++++++------ testes/errors.lua | 7 +++++++ 2 files changed, 17 insertions(+), 6 deletions(-) diff --git a/ldebug.c b/ldebug.c index 603c39fc1..8e3657a92 100644 --- a/ldebug.c +++ b/ldebug.c @@ -638,14 +638,18 @@ static const char *funcnamefromcode (lua_State *L, CallInfo *ci, /* -** The subtraction of two potentially unrelated pointers is -** not ISO C, but it should not crash a program; the subsequent -** checks are ISO C and ensure a correct result. +** Check whether pointer 'o' points to some value in the stack +** frame of the current function. Because 'o' may not point to a +** value in this stack, we cannot compare it with the region +** boundaries (undefined behaviour in ISO C). */ static int isinstack (CallInfo *ci, const TValue *o) { - StkId base = ci->func + 1; - ptrdiff_t i = cast(StkId, o) - base; - return (0 <= i && i < (ci->top - base) && s2v(base + i) == o); + StkId pos; + for (pos = ci->func + 1; pos < ci->top; pos++) { + if (o == s2v(pos)) + return 1; + } + return 0; /* not found */ } diff --git a/testes/errors.lua b/testes/errors.lua index 4249f5703..fd02806e3 100644 --- a/testes/errors.lua +++ b/testes/errors.lua @@ -191,6 +191,13 @@ checkmessage("a = 24 // 0", "divide by zero") checkmessage("a = 1 % 0", "'n%0'") +-- type error for an object which is neither in an upvalue nor a register. +-- The following code will try to index the value 10 that is stored in +-- the metatable, without moving it to a register. +checkmessage("local a = setmetatable({}, {__index = 10}).x", + "attempt to index a number value") + + -- numeric for loops checkmessage("for i = {}, 10 do end", "table") checkmessage("for i = io.stdin, 10 do end", "FILE")