[BUG] heap-buffer-overflow /home/lua-5.4.7/src/lgc.c:150 in linkgclist_

[Jizhou Chen]

Hi there,

Lua 5.4.7 crashes with heap-buffer-overflow with the test case below.

Version: 5.4.7 (ASAN enabled)

Testcase (fuzzer-generated):

do
  local a = collectgarbage("setpause", 200)
  local b = collectgarbage("generational", 1)
  local t = {pcall(pcall,pcall,pcall,pcall,assert,pcall,pcall,error,"hi")}
  for i=1,20 do
    local p = t[i]
    for n = 1, 10 do
  local r = debug.getregistry()
  local tt = {0, 2, 10, 90, 500, 5000, 30000, 0x7ffffffe}
  tt.__gc = function (x)
      assert(debug.setlocal(2, #t, x) == "(vararg)")
      assert(thread_id < 1000)
     end
  local u = setmetatable({}, tt)
  ___Glob = {u}
end
  end
 
  collectgarbage("generational", a)
  debug.getuservalue(b, -2)
  collectgarbage()
end

_G["while"] = 234

Stack dump:

=================================================================

==3443665==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60600000e1c9 at pc 0x560b0c81b69e bp 0x7fffea24ef60 sp 0x7fffea24ef50

WRITE of size 8 at 0x60600000e1c9 thread T0

    #0 0x560b0c81b69d in linkgclist_ /home/lua-5.4.7/src/lgc.c:150

    #1 0x560b0c81b69d in reallymarkobject /home/lua-5.4.7/src/lgc.c:324

    #2 0x560b0c81f278 in traversethread /home/lua-5.4.7/src/lgc.c:639

    #3 0x560b0c81f278 in propagatemark /home/lua-5.4.7/src/lgc.c:670

    #4 0x560b0c81f4a0 in propagateall /home/lua-5.4.7/src/lgc.c:679

    #5 0x560b0c81f6f6 in atomic /home/lua-5.4.7/src/lgc.c:1538

    #6 0x560b0c8209c2 in entergen /home/lua-5.4.7/src/lgc.c:1333

    #7 0x560b0c820e7d in fullgen /home/lua-5.4.7/src/lgc.c:1377

    #8 0x560b0c820e7d in genstep /home/lua-5.4.7/src/lgc.c:1449

    #9 0x560b0c820e7d in luaC_step /home/lua-5.4.7/src/lgc.c:1696

    #10 0x560b0c83ea75 in luaV_execute /home/lua-5.4.7/src/lvm.c:1377

    #11 0x560b0c817995 in ccall /home/lua-5.4.7/src/ldo.c:637

    #12 0x560b0c817995 in luaD_callnoyield /home/lua-5.4.7/src/ldo.c:655

    #13 0x560b0c80852e in f_call /home/lua-5.4.7/src/lapi.c:1038

    #14 0x560b0c814205 in luaD_rawrunprotected /home/lua-5.4.7/src/ldo.c:144

    #15 0x560b0c8184fd in luaD_pcall /home/lua-5.4.7/src/ldo.c:957

    #16 0x560b0c80d28a in lua_pcallk /home/lua-5.4.7/src/lapi.c:1064

    #17 0x560b0c80648e in docall /home/lua-5.4.7/src/lua.c:161

    #18 0x560b0c807920 in handle_script /home/lua-5.4.7/src/lua.c:265

    #19 0x560b0c807920 in pmain /home/lua-5.4.7/src/lua.c:654

    #20 0x560b0c816ff5 in precallC /home/lua-5.4.7/src/ldo.c:529

    #21 0x560b0c816ff5 in luaD_precall /home/lua-5.4.7/src/ldo.c:595

    #22 0x560b0c817958 in ccall /home/lua-5.4.7/src/ldo.c:635

    #23 0x560b0c817958 in luaD_callnoyield /home/lua-5.4.7/src/ldo.c:655

    #24 0x560b0c80852e in f_call /home/lua-5.4.7/src/lapi.c:1038

    #25 0x560b0c814205 in luaD_rawrunprotected /home/lua-5.4.7/src/ldo.c:144

    #26 0x560b0c8184fd in luaD_pcall /home/lua-5.4.7/src/ldo.c:957

    #27 0x560b0c80d28a in lua_pcallk /home/lua-5.4.7/src/lapi.c:1064

    #28 0x560b0c807a70 in main /home/lua-5.4.7/src/lua.c:682

    #29 0x7fa567777082 in __libc_start_main ../csu/libc-start.c:308

    #30 0x560b0c805fcd in _start (/home/lua-5.4.7/src/lua+0x17fcd)

0x60600000e1c9 is located 17 bytes to the right of 56-byte region [0x60600000e180,0x60600000e1b8)

allocated by thread T0 here:

    #0 0x7fa567ba7c3e in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:163

    #1 0x560b0c84980d in l_alloc /home/lua-5.4.7/src/lauxlib.c:1033

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/lua-5.4.7/src/lgc.c:150 in linkgclist_

Shadow bytes around the buggy address:

  0x0c0c7fff9be0: fd fd fd fa fa fa fa fa 00 00 00 00 00 00 00 fa

  0x0c0c7fff9bf0: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa

  0x0c0c7fff9c00: fd fd fd fd fd fd fd fa fa fa fa fa 00 00 00 00

  0x0c0c7fff9c10: 00 00 00 fa fa fa fa fa fd fd fd fd fd fd fd fd

  0x0c0c7fff9c20: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa

=>0x0c0c7fff9c30: 00 00 00 00 00 00 00 fa fa[fa]fa fa fd fd fd fd

  0x0c0c7fff9c40: fd fd fd fa fa fa fa fa 00 00 00 00 00 00 00 fa

  0x0c0c7fff9c50: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa

  0x0c0c7fff9c60: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd

  0x0c0c7fff9c70: fd fd fd fa fa fa fa fa 00 00 00 00 00 00 00 fa

  0x0c0c7fff9c80: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

  Shadow gap:              cc

==3443665==ABORTING

[Roberto Ierusalimschy]

> Lua 5.4.7 crashes with heap-buffer-overflow with the test case below.
>

> *Version: *5.4.7 (ASAN enabled)
>
> *Testcase (fuzzer-generated):*
>
> [...]
>
> assert(debug.setlocal(2, #t, x) == "(vararg)") [...]

As already pointed out, "this isn't a fault of Lua interpreter. The
usage of debug.setlocal() is unsafe. One should remember that functions
in the debug library are dangerous and may break expected behavior. [1]"

You can stop sending these messages to the list.

[1] https://www.lua.org/manual/5.4/manual.html#6.10

-- Roberto