openresty / openresty/luajit2

When a special input is constructed, the Lua engine fails to parse the input and crash.

Open
#96 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
1.4k
Forks
252
Avg merge
7d 11h
Merged PRs (30d)
3

Description

When a special input is constructed, the Lua engine fails to parse the input and crashes.
For details about the special input, see poc1 to poc3 in the attachment.
When poc1 and poc3 are entered, a segment error occurs in the lj_str_original_hash function, resulting in crash.
When poc2 is entered, a segment error occurs after the lj_BC_JMP function is called, causing the system crash.

pls comfirm above, from Huawei & Tencent Enke Laboratory.

poc1.txt
poc2.txt
poc3.txt

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the crashes with poc1.txt, poc2.txt, and poc3.txt. Inspect the reported paths involving lj_str_original_hash and lj_BC_JMP, then trace the failing inputs through the LuaJIT engine. Done means the supplied inputs no longer crash the engine and regression coverage verifies the behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, lua
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.