[BUG] SEGV /home/lua-5.4.7/src/lapi.c:115 in lua_checkstack

[Jizhou Chen]

Hi there,

Lua 5.4.7 crashes with SEGV with the test case below. 

Version: 5.4.7 (ASAN enabled)

Testcase (fuzzer-generated):

NOTE: Different from other crashes I just reported, reproducing the crash with this test case appears to be a bit unstable. Based on my manual verification, the crash can be reproduced in about one of four runs. The rest runs may hang. If that happens, just kill it and rerun. 

a = {}
local t = {x = 10}
local C = setmetatable({key = testrep}, {__mode = 'v'})
local C1 = setmetatable({[t] = 1}, {__mode = 'k'})
a.x = t  


setmetatable(a, {__gc = function (u)
                          local a = collectgarbage("incremental", 200)
  local b = collectgarbage("setstepmul", 200)
  local t = {0, 2, 10, year = 2005, 500, 5000, 30000, 0x7ffffffe}
  for i=1,2 do
    local a = require "debug"
  for n,v in pairs(_G) do a[n]=v end
  for n,assert in pairs(a) do
    if debug.sethook(load(function () local function f(...) return require(string.rep('local a={}; return a.bbbb(3)', 40)) end
  local count = 0
  local a = {}
  for i = 23, 255 do
  local count = "2", " 3e0 ", " 10  "
    x = function () count = count + 1 end
    assert(a[not debug.setupvalue(assert, 1, 10)])
end
  debug.sethook(function () count = count + 1 end, "", 1)
  local t = {table.unpack(a)}
  assert(#t == 100)
  t = {table.unpack(a, 1, 3)}
  assert(#t == 3)
  t = {f([[
        pushnum 102
yieldk 1 U2
cannot be here!
]],
[[      # continuation
pushvalue U3   # accessing upvalues inside a continuation
        pushvalue U4
return *
]], 23, "huu")}
  assert(#t == 31) end), 1) == "" and
       not string.find(n, "^[%u_]") then
      _G[n] = undef
    end
    collectgarbage()
  end
  end
 
  collectgarbage("setpause", a)
  collectgarbage("setstepmul", b)
  collectgarbage()
                          end})

co = coroutine.wrap(function ()
  collectgarbage("generational", 1)  
  local u = {}
  local s = {}; setmetatable(s, {__mode = 'k'})
  setmetatable(u, {__gc = function (o)
    local i = s[o]
    s[i] = true
    assert(not s[i - 1])  
    if i == 8 then error("@expected@") end  
  end})

  for i = 6, 10 do
    local x = setmetatable({}, getmetatable(u))
    s[n] = i
  end

  warn("@on"); warn("@store")
  collectgarbage()
  assert(string.find(_WARN, "error in __gc"))
  assert(string.match(_WARN, "@(.-)@") == "expected"); _WARN = false
  for i = 8, 10 do assert(s[i]) end

  for i = 1, 5 do
    local n = setmetatable({}, getmetatable(u))
    s[n] = i
  end

  collectgarbage()
  for i = 1, 10 do assert(s[i]) end

  getmetatable(u).__gc = nil
  warn("@normal")
end)
collectgarbage()
collectgarbage()
assert(next(C) == nil and next(C1) == nil)
C, C1 = nil

Stack dump:

AddressSanitizer:DEADLYSIGNAL

=================================================================

==938874==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000020 (pc 0x55a400ff6565 bp 0x000000000000 sp 0x7ffddf1ed610 T0)

==938874==The signal is caused by a READ memory access.

==938874==Hint: address points to the zero page.

    #0 0x55a400ff6564 in lua_checkstack /home/lua-5.4.7/src/lapi.c:115

    #1 0x55a401047156 in auxresume /home/lua-5.4.7/src/lcorolib.c:34

    #2 0x55a401047335 in luaB_auxwrap /home/lua-5.4.7/src/lcorolib.c:75

    #3 0x55a401004ce5 in precallC /home/lua-5.4.7/src/ldo.c:529

    #4 0x55a401004ce5 in luaD_precall /home/lua-5.4.7/src/ldo.c:592

    #5 0x55a4010340c4 in luaV_execute /home/lua-5.4.7/src/lvm.c:1682

    #6 0x55a401005995 in ccall /home/lua-5.4.7/src/ldo.c:637

    #7 0x55a401005995 in luaD_callnoyield /home/lua-5.4.7/src/ldo.c:655

    #8 0x55a400ffafd5 in lua_callk /home/lua-5.4.7/src/lapi.c:1020

    #9 0x55a4010464ac in generic_reader /home/lua-5.4.7/src/lbaselib.c:374

    #10 0x55a401036c17 in luaZ_fill /home/lua-5.4.7/src/lzio.c:28

    #11 0x55a401001fe6 in f_parser /home/lua-5.4.7/src/ldo.c:995

    #12 0x55a401002205 in luaD_rawrunprotected /home/lua-5.4.7/src/ldo.c:144

    #13 0x55a4010064fd in luaD_pcall /home/lua-5.4.7/src/ldo.c:957

    #14 0x55a4010068af in luaD_protectedparser /home/lua-5.4.7/src/ldo.c:1019

    #15 0x55a400ffb6c3 in lua_load /home/lua-5.4.7/src/lapi.c:1094

    #16 0x55a40104677b in luaB_load /home/lua-5.4.7/src/lbaselib.c:401

    #17 0x55a401004ff5 in precallC /home/lua-5.4.7/src/ldo.c:529

    #18 0x55a401004ff5 in luaD_precall /home/lua-5.4.7/src/ldo.c:595

    #19 0x55a4010340c4 in luaV_execute /home/lua-5.4.7/src/lvm.c:1682

    #20 0x55a401005995 in ccall /home/lua-5.4.7/src/ldo.c:637

    #21 0x55a401005995 in luaD_callnoyield /home/lua-5.4.7/src/ldo.c:655

    #22 0x55a40100b3db in dothecall /home/lua-5.4.7/src/lgc.c:903

    #23 0x55a401002205 in luaD_rawrunprotected /home/lua-5.4.7/src/ldo.c:144

    #24 0x55a4010064fd in luaD_pcall /home/lua-5.4.7/src/ldo.c:957

    #25 0x55a40100b19d in GCTM /home/lua-5.4.7/src/lgc.c:923

    #26 0x55a40100b373 in callallpendingfinalizers /home/lua-5.4.7/src/lgc.c:953

    #27 0x55a40100eae2 in luaC_freeallobjects /home/lua-5.4.7/src/lgc.c:1517

    #28 0x55a40101d44b in close_state /home/lua-5.4.7/src/lstate.c:276

    #29 0x55a40101eeaf in lua_close /home/lua-5.4.7/src/lstate.c:419

    #30 0x55a400ff5a94 in main /home/lua-5.4.7/src/lua.c:685

    #31 0x7fefc8651082 in __libc_start_main ../csu/libc-start.c:308

    #32 0x55a400ff3fcd in _start (/home/lua-5.4.7/src/lua+0x17fcd)

AddressSanitizer can not provide additional info.

SUMMARY: AddressSanitizer: SEGV /home/lua-5.4.7/src/lapi.c:115 in lua_checkstack

==938874==ABORTING