Bug: Use after free in 'luaV_finishset'

If a metatable is a weak table, its __newindex field could be collected
by an emergency collection while being used in 'luaV_finishset'. (This
bug has similarities with bug 5.3.2-1, fixed in commit a272fa66.)
This commit is contained in:
Roberto Ierusalimschy
2025-03-13 15:42:39 -03:00
parent 25da574fcb
commit 983bc433e6
2 changed files with 16 additions and 0 deletions

View File

@@ -370,6 +370,19 @@ x = 0 .."a".."b"..c..d.."e".."f".."g"
assert(x.val == "0abcdefg")
do
-- bug since 5.4.1
local mt = setmetatable({__newindex={}}, {__mode='v'})
local t = setmetatable({}, mt)
if T then T.allocfailnext() end
-- seg. fault
for i=1, 10 do t[i] = 1 end
end
-- concat metamethod x numbers (bug in 5.1.1)
c = {}
local x