mirror of
https://github.com/lua/lua.git
synced 2026-09-10 04:18:10 +00:00
Bug: Use after free in 'luaV_finishset'
If a metatable is a weak table, its __newindex field could be collected by an emergency collection while being used in 'luaV_finishset'. (This bug has similarities with bug 5.3.2-1, fixed in commit a272fa66.)
This commit is contained in:
@@ -370,6 +370,19 @@ x = 0 .."a".."b"..c..d.."e".."f".."g"
|
||||
assert(x.val == "0abcdefg")
|
||||
|
||||
|
||||
do
|
||||
-- bug since 5.4.1
|
||||
local mt = setmetatable({__newindex={}}, {__mode='v'})
|
||||
local t = setmetatable({}, mt)
|
||||
|
||||
if T then T.allocfailnext() end
|
||||
|
||||
-- seg. fault
|
||||
for i=1, 10 do t[i] = 1 end
|
||||
end
|
||||
|
||||
|
||||
|
||||
-- concat metamethod x numbers (bug in 5.1.1)
|
||||
c = {}
|
||||
local x
|
||||
|
||||
Reference in New Issue
Block a user