CVE-2022-33099: Out-of-bounds Write (CWE-787)
value: An issue in the component luaG_runerror of Lua v5.4.4 and below leads to a heap-buffer overflow when a recursive error occurs.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2022-07-01T12:15Z
Repository: https://github.com/lua/lua
Language: C
Files changed: ldebug.c, lvm.c
Commit date: 2022-05-20 13:14:33 -0300
Commit message: Save stack space while handling errors

Because error handling (luaG_errormsg) uses slots from EXTRA_STACK,
and some errors can recur (e.g., string overflow while creating an
error message in 'luaG_runerror', or a C-stack overflow before calling
the message handler), the code should use stack slots with parsimony.

This commit fixes the bug "Lua-stack overflow when C stack overflows
while handling an error".

Diff: diff --git a/ldebug.c b/ldebug.c
index a716d95e2..fa15eaf68 100644
--- a/ldebug.c
+++ b/ldebug.c
@@ -822,12 +822,15 @@ l_noret luaG_runerror (lua_State *L, const char *fmt, ...) {
   va_list argp;
   luaC_checkGC(L);  /* error message uses memory */
   va_start(argp, fmt);
   msg = luaO_pushvfstring(L, fmt, argp);  /* format message */
   va_end(argp);
-  if (isLua(ci))  /* if Lua function, add source:line information */
+  if (isLua(ci)) {  /* if Lua function, add source:line information */
     luaG_addinfo(L, msg, ci_func(ci)->p->source, getcurrentline(ci));
+    setobjs2s(L, L->top - 2, L->top - 1);  /* remove 'msg' from the stack */
+    L->top--;
+  }
   luaG_errormsg(L);
 }
 
 
 /*
diff --git a/lvm.c b/lvm.c
index e8c2e9627..cd992aada 100644
--- a/lvm.c
+++ b/lvm.c
@@ -654,12 +654,14 @@ void luaV_concat (lua_State *L, int total) {
       size_t tl = vslen(s2v(top - 1));
       TString *ts;
       /* collect total length and number of strings */
       for (n = 1; n < total && tostring(L, s2v(top - n - 1)); n++) {
         size_t l = vslen(s2v(top - n - 1));
-        if (l_unlikely(l >= (MAX_SIZE/sizeof(char)) - tl))
+        if (l_unlikely(l >= (MAX_SIZE/sizeof(char)) - tl)) {
+          L->top = top - total;  /* pop strings to avoid wasting stack */
           luaG_runerror(L, "string length overflow");
+        }
         tl += l;
       }
       if (tl <= LUAI_MAXSHORTLEN) {  /* is result a short string? */
         char buff[LUAI_MAXSHORTLEN];
         copy2buff(top, n, buff);  /* copy strings to buffer */
@@ -670,11 +672,11 @@ void luaV_concat (lua_State *L, int total) {
         copy2buff(top, n, getstr(ts));
       }
       setsvalue2s(L, top - n, ts);  /* create result */
     }
     total -= n-1;  /* got 'n' strings to create 1 new */
-    L->top -= n-1;  /* popped 'n' strings and pushed one */
+    L->top = top - (n - 1);  /* popped 'n' strings and pushed one */
   } while (total > 1);  /* repeat until only 1 result left */
 }
 
 
 /*

Vulnerable code:   if (isLua(ci))  /* if Lua function, add source:line information */
        if (l_unlikely(l >= (MAX_SIZE/sizeof(char)) - tl))
    L->top -= n-1;  /* popped 'n' strings and pushed one */
Fixed code:   if (isLua(ci)) {  /* if Lua function, add source:line information */
    setobjs2s(L, L->top - 2, L->top - 1);  /* remove 'msg' from the stack */
    L->top--;
  }
        if (l_unlikely(l >= (MAX_SIZE/sizeof(char)) - tl)) {
          L->top = top - total;  /* pop strings to avoid wasting stack */
        }
    L->top = top - (n - 1);  /* popped 'n' strings and pushed one */