gh-mirror/mikepaul-LuaJIT
1
0
Fork 0
mirror of https://github.com/LuaJIT/LuaJIT.git synced 2025-02-07 23:24:09 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

FFI: Fix dangling reference to CType. Improve checks.

Browse Source 
Reported by elmknot.
This commit is contained in:
Mike Pall 2022-12-07 17:19:29 +01:00
parent 1c5113aea9
commit cc96ab9d51
2 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/lj_crecord.c
View File

@ -1396,9 +1396,13 @@ void LJ_FASTCALL recff_cdata_arith(jit_State *J, RecordFFData *rd)
if (ctype_isenum(ct->info)) ct = ctype_child(cts, ct); if (ctype_isenum(ct->info)) ct = ctype_child(cts, ct);
goto ok; goto ok;
} else if (ctype_isfunc(ct->info)) { } else if (ctype_isfunc(ct->info)) {
CTypeID id0 = i ? ctype_typeid(cts, s[0]) : 0;
tr = emitir(IRT(IR_FLOAD, IRT_PTR), tr, IRFL_CDATA_PTR); tr = emitir(IRT(IR_FLOAD, IRT_PTR), tr, IRFL_CDATA_PTR);
ct = ctype_get(cts, ct = ctype_get(cts,
lj_ctype_intern(cts, CTINFO(CT_PTR, CTALIGN_PTR|id), CTSIZE_PTR)); lj_ctype_intern(cts, CTINFO(CT_PTR, CTALIGN_PTR|id), CTSIZE_PTR));
if (i) {
s[0] = ctype_get(cts, id0); /* cts->tab may have been reallocated. */
}
goto ok; goto ok;
} else { } else {
tr = emitir(IRT(IR_ADD, IRT_PTR), tr, lj_ir_kintp(J, sizeof(GCcdata))); tr = emitir(IRT(IR_ADD, IRT_PTR), tr, lj_ir_kintp(J, sizeof(GCcdata)));

12
src/lj_ctype.c
View File

@ -187,8 +187,20 @@ CTypeID lj_ctype_intern(CTState *cts, CTInfo info, CTSize size)
} }
id = cts->top; id = cts->top;
if (LJ_UNLIKELY(id >= cts->sizetab)) { if (LJ_UNLIKELY(id >= cts->sizetab)) {
#ifdef LUAJIT_CTYPE_CHECK_ANCHOR
CType *ct;
#endif
if (id >= CTID_MAX) lj_err_msg(cts->L, LJ_ERR_TABOV); if (id >= CTID_MAX) lj_err_msg(cts->L, LJ_ERR_TABOV);
#ifdef LUAJIT_CTYPE_CHECK_ANCHOR
ct = lj_mem_newvec(cts->L, id+1, CType);
memcpy(ct, cts->tab, id*sizeof(CType));
memset(cts->tab, 0, id*sizeof(CType));
lj_mem_freevec(cts->g, cts->tab, cts->sizetab, CType);
cts->tab = ct;
cts->sizetab = id+1;
#else
lj_mem_growvec(cts->L, cts->tab, cts->sizetab, CTID_MAX, CType); lj_mem_growvec(cts->L, cts->tab, cts->sizetab, CTID_MAX, CType);
#endif
} }
cts->top = id+1; cts->top = id+1;
cts->tab[id].info = info; cts->tab[id].info = info;