diff mbox series

[1/2] lua: Backport fix for CVE-2021-43396

Message ID 20211115115123.3978178-1-richard.purdie@linuxfoundation.org
State Accepted, archived
Commit e74fb3f7a8171cc1293583241a9ef43a515a9320
Headers show
Series [1/2] lua: Backport fix for CVE-2021-43396 | expand

Commit Message

Richard Purdie Nov. 15, 2021, 11:51 a.m. UTC 
Backport the fix for CVE-2021-43396 ("C stack overflow with coroutines")
from upstream.

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
 ...9057a5146755e737c479850f87fd0e3b6868.patch | 43 +++++++++++++++++++
 meta/recipes-devtools/lua/lua_5.4.3.bb        |  1 +
 2 files changed, 44 insertions(+)
 create mode 100644 meta/recipes-devtools/lua/lua/74d99057a5146755e737c479850f87fd0e3b6868.patch
diff mbox series

Patch

diff --git a/meta/recipes-devtools/lua/lua/74d99057a5146755e737c479850f87fd0e3b6868.patch b/meta/recipes-devtools/lua/lua/74d99057a5146755e737c479850f87fd0e3b6868.patch
new file mode 100644
index 00000000000..dcdc04837d6
--- /dev/null
+++ b/meta/recipes-devtools/lua/lua/74d99057a5146755e737c479850f87fd0e3b6868.patch
@@ -0,0 +1,43 @@ 
+From 74d99057a5146755e737c479850f87fd0e3b6868 Mon Sep 17 00:00:00 2001
+From: Roberto Ierusalimschy <roberto@inf.puc-rio.br>
+Date: Wed, 3 Nov 2021 15:04:18 -0300
+Subject: [PATCH] Bug: C stack overflow with coroutines
+
+'coroutine.resume' did not increment counter of C calls when
+continuing execution after a protected error (that is,
+while running 'precover').
+---
+ ldo.c             |  6 ++++--
+ testes/cstack.lua | 14 ++++++++++++++
+ 2 files changed, 18 insertions(+), 2 deletions(-)
+
+Upstream-Status: Backport [https://github.com/lua/lua/commit/74d99057a5146755e737c479850f87fd0e3b6868.patch]
+CVE: CVE-2021-43519
+
+diff --git a/src/ldo.c b/src/ldo.c
+index d0edc8b4f..66f890364 100644
+--- a/src/ldo.c
++++ b/src/ldo.c
+@@ -759,11 +759,10 @@ static void resume (lua_State *L, void *ud) {
+   StkId firstArg = L->top - n;  /* first argument */
+   CallInfo *ci = L->ci;
+   if (L->status == LUA_OK)  /* starting a coroutine? */
+-    ccall(L, firstArg - 1, LUA_MULTRET, 1);  /* just call its body */
++    ccall(L, firstArg - 1, LUA_MULTRET, 0);  /* just call its body */
+   else {  /* resuming from previous yield */
+     lua_assert(L->status == LUA_YIELD);
+     L->status = LUA_OK;  /* mark that it is running (again) */
+-    luaE_incCstack(L);  /* control the C stack */
+     if (isLua(ci)) {  /* yielded inside a hook? */
+       L->top = firstArg;  /* discard arguments */
+       luaV_execute(L, ci);  /* just continue running Lua code */
+@@ -814,6 +813,9 @@ LUA_API int lua_resume (lua_State *L, lua_State *from, int nargs,
+   else if (L->status != LUA_YIELD)  /* ended with errors? */
+     return resume_error(L, "cannot resume dead coroutine", nargs);
+   L->nCcalls = (from) ? getCcalls(from) : 0;
++  if (getCcalls(L) >= LUAI_MAXCCALLS)
++    return resume_error(L, "C stack overflow", nargs);
++  L->nCcalls++;
+   luai_userstateresume(L, nargs);
+   api_checknelems(L, (L->status == LUA_OK) ? nargs + 1 : nargs);
+   status = luaD_rawrunprotected(L, resume, &nargs);
diff --git a/meta/recipes-devtools/lua/lua_5.4.3.bb b/meta/recipes-devtools/lua/lua_5.4.3.bb
index 0224744fe7a..a204242bc02 100644
--- a/meta/recipes-devtools/lua/lua_5.4.3.bb
+++ b/meta/recipes-devtools/lua/lua_5.4.3.bb
@@ -7,6 +7,7 @@  HOMEPAGE = "http://www.lua.org/"
 SRC_URI = "http://www.lua.org/ftp/lua-${PV}.tar.gz;name=tarballsrc \
            file://lua.pc.in \
            ${@bb.utils.contains('DISTRO_FEATURES', 'ptest', 'http://www.lua.org/tests/lua-${PV_testsuites}-tests.tar.gz;name=tarballtest file://run-ptest ', '', d)} \
+           file://74d99057a5146755e737c479850f87fd0e3b6868.patch \
            "
 
 # if no test suite matches PV release of Lua exactly, download the suite for the closest Lua release.