-
Notifications
You must be signed in to change notification settings - Fork 3
Open
Description
Bytecode parser in PUC Rio Lua does not strict and malicious bytecode can trigger assertions enabled by macro LUAI_ASSERT (internal assertions for in-house debugging). These cases are often false positive.
Let's consider disabling LUAI_ASSERT in the following tests: luaL_loadbufferx_test 1, lua_load_test 2 and lua_dump_test 3.
See:
- luaL_loadbufferx_test fuzzer crashes in
loadString
in lundump.c #132 - lua_dump_test, https://oss-fuzz.com/testcase-detail/5639714608840704
- lua_load_test, https://oss-fuzz.com/testcase-detail/4813531965095936
Footnotes
-
https://github.com/ligurio/lua-c-api-tests/blob/0508724910b252010ae5f6bcaef0e54cf198cf5b/tests/capi/luaL_loadbufferx_test.c ↩
-
https://github.com/ligurio/lua-c-api-tests/blob/0508724910b252010ae5f6bcaef0e54cf198cf5b/tests/capi/lua_load_test.cc ↩
-
https://github.com/ligurio/lua-c-api-tests/blob/0508724910b252010ae5f6bcaef0e54cf198cf5b/tests/capi/lua_dump_test.c ↩
Metadata
Metadata
Assignees
Labels
No labels