From fe13f9dfd12c0a7f08355b83e34e7dec1bfdd86d Mon Sep 17 00:00:00 2001 From: Jude Melton-Houghton Date: Sun, 11 Sep 2022 13:28:37 -0400 Subject: Fix potential use-after-free with item metadata (#12729) This fixes a use-after-free bug in the case where itemstack metadata is accessed after the itemstack has been garbage-collected. --- src/script/lua_api/l_itemstackmeta.cpp | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) (limited to 'src/script/lua_api/l_itemstackmeta.cpp') diff --git a/src/script/lua_api/l_itemstackmeta.cpp b/src/script/lua_api/l_itemstackmeta.cpp index 739fb9221..c17bb8995 100644 --- a/src/script/lua_api/l_itemstackmeta.cpp +++ b/src/script/lua_api/l_itemstackmeta.cpp @@ -38,12 +38,12 @@ ItemStackMetaRef* ItemStackMetaRef::checkobject(lua_State *L, int narg) Metadata* ItemStackMetaRef::getmeta(bool auto_create) { - return &istack->metadata; + return &istack->getItem().metadata; } void ItemStackMetaRef::clearMeta() { - istack->metadata.clear(); + istack->getItem().metadata.clear(); } void ItemStackMetaRef::reportMetadataChange(const std::string *name) @@ -67,6 +67,16 @@ int ItemStackMetaRef::l_set_tool_capabilities(lua_State *L) return 0; } +ItemStackMetaRef::ItemStackMetaRef(LuaItemStack *istack): istack(istack) +{ + istack->grab(); +} + +ItemStackMetaRef::~ItemStackMetaRef() +{ + istack->drop(); +} + // garbage collector int ItemStackMetaRef::gc_object(lua_State *L) { ItemStackMetaRef *o = *(ItemStackMetaRef **)(lua_touserdata(L, 1)); @@ -76,7 +86,7 @@ int ItemStackMetaRef::gc_object(lua_State *L) { // Creates an NodeMetaRef and leaves it on top of stack // Not callable from Lua; all references are created on the C side. -void ItemStackMetaRef::create(lua_State *L, ItemStack *istack) +void ItemStackMetaRef::create(lua_State *L, LuaItemStack *istack) { ItemStackMetaRef *o = new ItemStackMetaRef(istack); //infostream<<"NodeMetaRef::create: o="<