mirror of
https://git.proxmox.com/git/mirror_zfs.git
synced 2024-12-25 02:49:32 +03:00
LUA: Backport CVE-2020-24370's patch
CVE-2020-24370 is a security vulnerability in lua. Although the CVE description in CVE-2020-24370 said that this CVE only affected lua 5.4.0, according to lua this CVE actually existed since lua 5.2. The root cause of this CVE is the negation overflow that occurs when you try to take the negative of 0x80000000. Thus, this CVE also exists in openzfs. Try to backport the fix to the lua in openzfs since the original fix is for 5.4 and several functions have been changed. https://github.com/advisories/GHSA-gfr4-c37g-mm3v https://nvd.nist.gov/vuln/detail/CVE-2020-24370 https://www.lua.org/bugs.html#5.4.0-11 https://github.com/lua/lua/commit/a585eae6e7ada1ca9271607a4f48dfb1786 Reviewed-by: Tony Hutter <hutter2@llnl.gov> Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Signed-off-by: ChenHao Lu <18302010006@fudan.edu.cn> Closes #15847
This commit is contained in:
parent
0823388752
commit
229b9f4ed0
@ -111,10 +111,11 @@ static const char *upvalname (Proto *p, int uv) {
|
|||||||
|
|
||||||
static const char *findvararg (CallInfo *ci, int n, StkId *pos) {
|
static const char *findvararg (CallInfo *ci, int n, StkId *pos) {
|
||||||
int nparams = clLvalue(ci->func)->p->numparams;
|
int nparams = clLvalue(ci->func)->p->numparams;
|
||||||
if (n >= ci->u.l.base - ci->func - nparams)
|
int nvararg = cast_int(ci->u.l.base - ci->func) - nparams;
|
||||||
|
if (n <= -nvararg)
|
||||||
return NULL; /* no such vararg */
|
return NULL; /* no such vararg */
|
||||||
else {
|
else {
|
||||||
*pos = ci->func + nparams + n;
|
*pos = ci->func + nparams - n;
|
||||||
return "(*vararg)"; /* generic name for any vararg */
|
return "(*vararg)"; /* generic name for any vararg */
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@ -126,7 +127,7 @@ static const char *findlocal (lua_State *L, CallInfo *ci, int n,
|
|||||||
StkId base;
|
StkId base;
|
||||||
if (isLua(ci)) {
|
if (isLua(ci)) {
|
||||||
if (n < 0) /* access to vararg values? */
|
if (n < 0) /* access to vararg values? */
|
||||||
return findvararg(ci, -n, pos);
|
return findvararg(ci, n, pos);
|
||||||
else {
|
else {
|
||||||
base = ci->u.l.base;
|
base = ci->u.l.base;
|
||||||
name = luaF_getlocalname(ci_func(ci)->p, n, currentpc(ci));
|
name = luaF_getlocalname(ci_func(ci)->p, n, currentpc(ci));
|
||||||
|
Loading…
Reference in New Issue
Block a user