github/redis
1
1
Fork 0
mirror of https://github.com/redis/redis.git synced 2026-04-21 03:01:35 -04:00
Code Issues Packages Projects Releases Wiki Activity

Fix LUA garbage collector (CVE-2024-46981)

Browse Source 
Reset GC state before closing the lua VM to prevent user data
to be wrongly freed while still might be used on destructor callbacks.
This commit is contained in:
YaacovHazan
2024-12-15 21:41:45 +02:00
committed by YaacovHazan
parent 4a95b3005a
commit 342ee426ad
2 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
src/eval.c
View File

@@ -266,6 +266,7 @@ void freeLuaScriptsSync(dict *lua_scripts, list *lua_scripts_lru_list, lua_State
unsigned int lua_tcache = (unsigned int)(uintptr_t)ud;
#endif
lua_gc(lua, LUA_GCCOLLECT, 0);
lua_close(lua);
#if defined(USE_JEMALLOC)

1
src/function_lua.c
View File

@@ -198,6 +198,7 @@ static void luaEngineFreeCtx(void *engine_ctx) {
unsigned int lua_tcache = (unsigned int)(uintptr_t)ud;
#endif
lua_gc(lua_engine_ctx->lua, LUA_GCCOLLECT, 0);
lua_close(lua_engine_ctx->lua);
zfree(lua_engine_ctx);