termux-packages/packages/liblua54/CVE-2020-15889.patch

36 lines
1.4 KiB
Diff
Raw Normal View History

commit 127e7a6c8942b362aa3c6627f44d660a4fb75312
Author: Roberto Ierusalimschy <roberto@inf.puc-rio.br>
Date: Fri Jul 10 14:13:50 2020 -0300
Fixed bug of old finalized objects in the GC
When an object aged OLD1 is finalized, it is moved from the list
'finobj' to the *beginning* of the list 'allgc'. So, this part of the
list (and not only the survival list) must be visited by 'markold'.
diff --git a/src/lgc.c b/src/lgc.c
index f26c921a..f7fd7a59 100644
--- a/src/lgc.c
+++ b/src/lgc.c
@@ -1131,16 +1131,14 @@ static void finishgencycle (lua_State *L, global_State *g) {
/*
-** Does a young collection. First, mark 'OLD1' objects. (Only survival
-** and "recent old" lists can contain 'OLD1' objects. New lists cannot
-** contain 'OLD1' objects, at most 'OLD0' objects that were already
-** visited when marked old.) Then does the atomic step. Then,
-** sweep all lists and advance pointers. Finally, finish the collection.
+** Does a young collection. First, mark 'OLD1' objects. Then does the
+** atomic step. Then, sweep all lists and advance pointers. Finally,
+** finish the collection.
*/
static void youngcollection (lua_State *L, global_State *g) {
GCObject **psurvival; /* to point to first non-dead survival object */
lua_assert(g->gcstate == GCSpropagate);
- markold(g, g->survival, g->reallyold);
+ markold(g, g->allgc, g->reallyold);
markold(g, g->finobj, g->finobjrold);
atomic(L);