Skip to content

fix(parser): prevent chunk from being garbage collected#3

Open
digitcrusher wants to merge 1 commit intoxcb-xwii:masterfrom
digitcrusher:master
Open

fix(parser): prevent chunk from being garbage collected#3
digitcrusher wants to merge 1 commit intoxcb-xwii:masterfrom
digitcrusher:master

Conversation

@digitcrusher
Copy link
Copy Markdown
Contributor

Holding a reference to the bytes of a string value which was popped off the stack is not safe since the data is now eligible to be freed by the garbage collector. Although this use-after-free bug is most prominent in a Lua interpreter with multiple threads of execution, it might also happen in a single-threaded one. This hypothesis is backed by section 4.1.3 "Pointers to Strings" of the Lua reference manual:

[…] In general, Lua's garbage collection can free or move memory and then invalidate pointers to strings handled by a Lua state. To allow a safe use of these pointers, the API guarantees that any pointer to a string in a stack index is valid while the string value at that index is not removed from the stack. […] Except for these guarantees, the garbage collector is free to invalidate any pointer to internal strings.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant