luanti-org/luanti
1
0
Fork 0
mirror of https://github.com/luanti-org/luanti.git synced 2025-10-16 09:55:22 +02:00
Code Activity

Fix potential use-after-free with item metadata (#12729)

Browse Source 
This fixes a use-after-free bug in the case where itemstack metadata is accessed after the itemstack has been garbage-collected.
This commit is contained in:
Jude Melton-Houghton
2022-09-11 13:28:37 -04:00
committed by GitHub
parent 7486f184c3
commit fe13f9dfd1
5 changed files with 47 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
src/script/lua_api/l_itemstackmeta.cpp
View File

@@ -38,12 +38,12 @@ ItemStackMetaRef* ItemStackMetaRef::checkobject(lua_State *L, int narg)
Metadata* ItemStackMetaRef::getmeta(bool auto_create)
{
return &istack->metadata;
return &istack->getItem().metadata;
}
void ItemStackMetaRef::clearMeta()
{
istack->metadata.clear();
istack->getItem().metadata.clear();
}
void ItemStackMetaRef::reportMetadataChange(const std::string *name)
@@ -67,6 +67,16 @@ int ItemStackMetaRef::l_set_tool_capabilities(lua_State *L)
return 0;
}
ItemStackMetaRef::ItemStackMetaRef(LuaItemStack *istack): istack(istack)
{
istack->grab();
}
ItemStackMetaRef::~ItemStackMetaRef()
{
istack->drop();
}
// garbage collector
int ItemStackMetaRef::gc_object(lua_State *L) {
ItemStackMetaRef *o = *(ItemStackMetaRef **)(lua_touserdata(L, 1));
@@ -76,7 +86,7 @@ int ItemStackMetaRef::gc_object(lua_State *L) {
// Creates an NodeMetaRef and leaves it on top of stack
// Not callable from Lua; all references are created on the C side.
void ItemStackMetaRef::create(lua_State *L, ItemStack *istack)
void ItemStackMetaRef::create(lua_State *L, LuaItemStack *istack)
{
ItemStackMetaRef *o = new ItemStackMetaRef(istack);
//infostream<<"NodeMetaRef::create: o="<<o<<std::endl;