mirror of https://github.com/mpv-player/mpv
32e851d2bc
Normally there was no issue, but when the code converted a deeply
nested table into an mpv node - it didn't ensure the stack has room.
Lua doesn't check stack overflow when invoking lua_push* functions,
and leaves this responsibility to the (c) user via lua_checkstack.
Normally that's not an issue because when a lua (or autofree) function
is called, it's guaranteed at least LUA_MINSTACK (20) pushes.
However, pushnode and makenode are recursive, and each iteration can
add few values at the stack (which are popped when the recursion
unwinds), so checkstack must be used on (recursive) entry.
pushnode already checked the stack, makenode did not.
This commit checks the stack at makenode as well. The value of 6
(stack places to reserve) is with some room to spare, and in pratice
each iteration needs 2-3 at most (pushnode also leaves room).
Example which could previously corrupt the stack:
utils.format_json({d1={d2={<8 more times>}}}
This uses makenode to convert the lua table into an mpv node which
the json writer uses as input, and if the depth is 10 or more then
corruption could occur. mp.command_native is also affected, as well as
any other mp/utils command which takes a lua table as input.
While at it, fix the error string which pushnode used (luaL_checkstack
uses the provided string with "Stack overflow (%s)", so the user
message only needs to be additional info).
|
||
|---|---|---|
| .. | ||
| javascript | ||
| lua | ||
| audio.c | ||
| client.c | ||
| client.h | ||
| command.c | ||
| command.h | ||
| configfiles.c | ||
| core.h | ||
| external_files.c | ||
| external_files.h | ||
| javascript.c | ||
| loadfile.c | ||
| lua.c | ||
| main.c | ||
| misc.c | ||
| osd.c | ||
| playloop.c | ||
| screenshot.c | ||
| screenshot.h | ||
| scripting.c | ||
| sub.c | ||
| video.c | ||