Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Off by one error with api_update_top in lua_rawiter #2053

@Sleitnick

Description

@Sleitnick

Luau's api_update_top macro asserts that the new top is less than ci->top, but the comparison should be less-or-equal instead. This macro is currently only used by lua_rawiter.

This results in an error when lua_rawiter is called with a stack size one greater than is needed, e.g. lua_rawiter calls api_update_top(L, top + 2) but this will fail if the stack can increase by exactly only 2.

Example repro:

// Assuming stack size hasn't grown and is still default 20

// Add a table with one item in it (so rawiter does something):
lua_settop(L, 18);
lua_createtable(L, 1, 0);
lua_pushnumber(L, 0);
lua_rawseti(L, -2, 1);

printf("top: %d\n", lua_gettop(L)); // "top: 19"

luaL_checkstack(L, 2, "resize failed"); // We should have a capacity of 21 now

// Throws an error from `api_update_top`:
lua_rawiter(L, -1, 0);

Fixing this should be as easy as changing < to <= in the api_check assertion.

Currently:

#define api_update_top(L, p) \
    { \
        api_check(L, p >= L->base && p < L->ci->top); \
        L->top = p; \
    }

Proposed api_check fix:

// ...
api_check(L, p >= L->base && p <= L->ci->top); \

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions