search

nodemcu / nodemcu-firmware

Lua based interactive firmware for ESP8266, ESP8285 and ESP32
https://nodemcu.readthedocs.io
MIT License
7.61k stars 3.12k forks source link

Here is a negation overflow in lua #3627

Closed Crispy-fried-chicken closed 1 week ago

Crispy-fried-chicken commented 5 months ago

CVE-2020-24370 is a security vulnerability in lua. Although the CVE decription in CVE-2020-24370 said that this CVE only affected lua 5.4.0, according to lua this CVE actually existed since lua 5.2. The root cause of this CVE is the negation overflow that occurs when you try to take the negative of 0x80000000. Thus, this CVE also exists in nodemcu-firmware in the file app/lua53/ldebug.c. Maybe you should try to backport the fix to the lua in nodemcu-firmwaresince the original fix is for 5.4 and several functions need to be changed. I'd like to open a PR for that if necessary.

pjsg commented 5 months ago

Please open a PR for that.

Crispy-fried-chicken commented 5 months ago

Please open a PR for that.

Sure, I've already opened, which is https://github.com/nodemcu/nodemcu-firmware/pull/3632, please check it, thank you!