Skip to content

Memory leaks in Lua: luaL_addgsub, luaL_gsub, luaL_loadbuffer #28

@ligurio

Description

@ligurio

Initially reported in #25 and oss-fuzz#58707.

How to reproduce

CC=clang CXX=clang++ cmake -S . -B build -DCMAKE_BUILD_TYPE=Debug -DUSE_LUA=ON
cmake --build build --parallel

luaL_addgsub_test:

./build/tests/luaL_addgsub_test
<snipped>
Indirect leak of 29 byte(s) in 1 object(s) allocated from:                                                                                  
    #0 0x559bc122c995 in realloc (/home/sergeyb/sources/lua-c-api-tests/build/tests/luaL_addgsub_test+0x145995) (BuildId: e31da1e432417eded9
ddb02691e605f88d0d01ad)                                                                                                                     
    #1 0x559bc13749bd in l_alloc /home/sergeyb/sources/lua-c-api-tests/build/lua-master/source/lauxlib.c:1024:12
    #2 0x559bc12db3bb in luaM_malloc_ /home/sergeyb/sources/lua-c-api-tests/build/lua-master/source/lmem.c:206:22                           
    #3 0x559bc12c1b83 in luaC_newobjdt /home/sergeyb/sources/lua-c-api-tests/build/lua-master/source/lgc.c:260:13                           
    #4 0x559bc12c1de4 in luaC_newobj /home/sergeyb/sources/lua-c-api-tests/build/lua-master/source/lgc.c:271:10
    #5 0x559bc1303550 in createstrobj /home/sergeyb/sources/lua-c-api-tests/build/lua-master/source/lstring.c:148:7
    #6 0x559bc130442c in internshrstr /home/sergeyb/sources/lua-c-api-tests/build/lua-master/source/lstring.c:208:8
    #7 0x559bc13032a2 in luaS_newlstr /home/sergeyb/sources/lua-c-api-tests/build/lua-master/source/lstring.c:223:12
    #8 0x559bc138cdc3 in luaX_init /home/sergeyb/sources/lua-c-api-tests/build/lua-master/source/llex.c:72:16
    #9 0x559bc12fff6d in f_luaopen /home/sergeyb/sources/lua-c-api-tests/build/lua-master/source/lstate.c:238:3
    #10 0x559bc12a786e in luaD_rawrunprotected /home/sergeyb/sources/lua-c-api-tests/build/lua-master/source/ldo.c:144:3
    #11 0x559bc12ff9aa in lua_newstate /home/sergeyb/sources/lua-c-api-tests/build/lua-master/source/lstate.c:407:7
    #12 0x559bc137486f in luaL_newstate /home/sergeyb/sources/lua-c-api-tests/build/lua-master/source/lauxlib.c:1095:18
    #13 0x559bc126b2f2 in LLVMFuzzerTestOneInput /home/sergeyb/sources/lua-c-api-tests/tests/luaL_addgsub_test.cc:25:17

<snipped>

Indirect leak of 32 byte(s) in 1 object(s) allocated from:                                                                                  
    #0 0x559bc122c995 in realloc (/home/sergeyb/sources/lua-c-api-tests/build/tests/luaL_addgsub_test+0x145995) (BuildId: e31da1e432417eded9
ddb02691e605f88d0d01ad)                                                                                                                     
    #1 0x559bc13749bd in l_alloc /home/sergeyb/sources/lua-c-api-tests/build/lua-master/source/lauxlib.c:1024:12                            
    #2 0x559bc12dad49 in luaM_realloc_ /home/sergeyb/sources/lua-c-api-tests/build/lua-master/source/lmem.c:180:14
    #3 0x559bc13075c2 in luaH_resize /home/sergeyb/sources/lua-c-api-tests/build/lua-master/source/ltable.c:573:14                          
    #4 0x559bc1301185 in init_registry /home/sergeyb/sources/lua-c-api-tests/build/lua-master/source/lstate.c:220:3                         
    #5 0x559bc12fff52 in f_luaopen /home/sergeyb/sources/lua-c-api-tests/build/lua-master/source/lstate.c:235:3
    #6 0x559bc12a786e in luaD_rawrunprotected /home/sergeyb/sources/lua-c-api-tests/build/lua-master/source/ldo.c:144:3
    #7 0x559bc12ff9aa in lua_newstate /home/sergeyb/sources/lua-c-api-tests/build/lua-master/source/lstate.c:407:7 
    #8 0x559bc137486f in luaL_newstate /home/sergeyb/sources/lua-c-api-tests/build/lua-master/source/lauxlib.c:1095:18
    #9 0x559bc126b2f2 in LLVMFuzzerTestOneInput /home/sergeyb/sources/lua-c-api-tests/tests/luaL_addgsub_test.cc:25:17

<snipped>

luaL_gsub_test:

./build/tests/luaL_gsub_test
<snipped>

Indirect leak of 29 byte(s) in 1 object(s) allocated from:
    #0 0x5614209bd995 in realloc (/home/sergeyb/sources/lua-c-api-tests/build/tests/luaL_gsub_test+0x145995) (BuildId: d5278ec1ec3fad35fd14e
bcd6b99d008099d8855)
    #1 0x561420b058cd in l_alloc /home/sergeyb/sources/lua-c-api-tests/build/lua-master/source/lauxlib.c:1024:12
    #2 0x561420a6c2cb in luaM_malloc_ /home/sergeyb/sources/lua-c-api-tests/build/lua-master/source/lmem.c:206:22
    #3 0x561420a52a93 in luaC_newobjdt /home/sergeyb/sources/lua-c-api-tests/build/lua-master/source/lgc.c:260:13
    #4 0x561420a52cf4 in luaC_newobj /home/sergeyb/sources/lua-c-api-tests/build/lua-master/source/lgc.c:271:10
    #5 0x561420a94460 in createstrobj /home/sergeyb/sources/lua-c-api-tests/build/lua-master/source/lstring.c:148:7
    #6 0x561420a9533c in internshrstr /home/sergeyb/sources/lua-c-api-tests/build/lua-master/source/lstring.c:208:8
    #7 0x561420a941b2 in luaS_newlstr /home/sergeyb/sources/lua-c-api-tests/build/lua-master/source/lstring.c:223:12
    #8 0x561420b1dcd3 in luaX_init /home/sergeyb/sources/lua-c-api-tests/build/lua-master/source/llex.c:72:16
    #9 0x561420a90e7d in f_luaopen /home/sergeyb/sources/lua-c-api-tests/build/lua-master/source/lstate.c:238:3
    #10 0x561420a3877e in luaD_rawrunprotected /home/sergeyb/sources/lua-c-api-tests/build/lua-master/source/ldo.c:144:3
    #11 0x561420a908ba in lua_newstate /home/sergeyb/sources/lua-c-api-tests/build/lua-master/source/lstate.c:407:7
    #12 0x561420b0577f in luaL_newstate /home/sergeyb/sources/lua-c-api-tests/build/lua-master/source/lauxlib.c:1095:18
    #13 0x5614209fc2f2 in LLVMFuzzerTestOneInput /home/sergeyb/sources/lua-c-api-tests/tests/luaL_gsub_test.cc:25:17

<snipped>

Is it a false positive or not?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions