openresty / luajit2

OpenResty's Branch of LuaJIT 2
https://luajit.org/luajit.html
Other
1.26k stars 202 forks source link

luaL_ref() has risks to allocate duplicated id #240

Open hatedog opened 3 months ago

hatedog commented 3 months ago

We found luaL_unref() does not do validations when called, so when it is called twice or more with the same id, the specific id will add to free list for twice or more. This will cause the succeeding luaL_ref() to allocate duplicated ids.

eg.

int fid = luaL_ref(L, LUA_REGISTRYINDEX); // suppose got: fid=2 ... ... luaL_unref(L, LUA_REGISTRYINDEX, fid); // ok, fid=2 add to free list luaL_unref(L, LUA_REGISTRYINDEX, fid); // if twice, ok again, fid=2 add to free list ... ... int id1 = luaL_ref(L, LUA_REGISTRYINDEX); // got: id1=2 ... ... int id2 = luaL_ref(L, LUA_REGISTRYINDEX); // got: id2=2, duplicated ... ...