Triplehx3/luanti
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix potential use-after-free with item metadata (#12729)

Browse Source 
This fixes a use-after-free bug in the case where itemstack metadata is accessed after the itemstack has been garbage-collected.
This commit is contained in:
Jude Melton-Houghton
2022-09-11 13:28:37 -04:00
committed by GitHub
parent 7486f184c3
commit fe13f9dfd1
5 changed files with 47 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
src/script/lua_api/l_itemstackmeta.h
View File

@@ -23,13 +23,13 @@ with this program; if not, write to the Free Software Foundation, Inc.,
#include "lua_api/l_base.h"
#include "lua_api/l_metadata.h"
#include "lua_api/l_item.h"
#include "irrlichttypes_bloated.h"
#include "inventory.h"
class ItemStackMetaRef : public MetaDataRef
{
private:
ItemStack *istack = nullptr;
LuaItemStack *istack;
static const char className[];
static const luaL_Reg methods[];
@@ -44,12 +44,12 @@ class ItemStackMetaRef : public MetaDataRef
void setToolCapabilities(const ToolCapabilities &caps)
{
istack->metadata.setToolCapabilities(caps);
istack->getItem().metadata.setToolCapabilities(caps);
}
void clearToolCapabilities()
{
istack->metadata.clearToolCapabilities();
istack->getItem().metadata.clearToolCapabilities();
}
// Exported functions
@@ -58,12 +58,15 @@ class ItemStackMetaRef : public MetaDataRef
// garbage collector
static int gc_object(lua_State *L);
public:
ItemStackMetaRef(ItemStack *istack): istack(istack) {}
~ItemStackMetaRef() = default;
// takes a reference
ItemStackMetaRef(LuaItemStack *istack);
~ItemStackMetaRef();
DISABLE_CLASS_COPY(ItemStackMetaRef)
// Creates an ItemStackMetaRef and leaves it on top of stack
// Not callable from Lua; all references are created on the C side.
static void create(lua_State *L, ItemStack *istack);
static void create(lua_State *L, LuaItemStack *istack);
static void Register(lua_State *L);
};