jianf/LuaCangjia_api
1
0
Fork 0
mirror of https://gitcode.com/JianFeeeee/LuaCangjia_api.git synced 2026-09-20 00:48:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: 修复 unload_lib/clean 的 lua_remove 栈索引越界(自 LuaJIT 分支回移)

Browse Source 
ref 记录 gettop+1, lua_remove 应使用 ref-1; clean() 中恒越界的
逐个 remove 循环为死代码(settop(L,0) 已清栈)予以删除。
该 bug 在 Lua 5.4 隐式容忍, 在严格实现下会损坏虚拟栈。
This commit is contained in:
JianFeeeee
2026-08-25 12:01:10 +08:00
parent d0cde5d767
commit b4ac3fa7b1
1 changed files with 3 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
lib/lua_runner.cpp
View File

@ -136,7 +136,7 @@ int Lua_runner::unload_lib(const char *name)
{
return -1;
}
lua_remove(this->L,this->pkgs[sig].ref);
lua_remove(this->L,this->pkgs[sig].ref - 1); // ref = gettop+1, 故用 ref-1 定位实际栈位置
for(int j = sig+1;j<this->pkg_cont;j++)
{
this->pkgs[j-1] = this->pkgs[j];//保持数据结构
@ -162,10 +162,8 @@ int Lua_runner::clean()//进行新一轮调用前一定要先clean清除上个
luaL_dostring(this->L, clean_globals_code);//清空全局变量
luaL_dostring(this->L, "package.loaded = {}");//清空当前引用的包
for(int i = 0 ;i<this->pkg_cont;i++)
{
lua_remove(this->L,this->pkgs[i].ref);
}
// 注: 原先此处有逐个 lua_remove(pkgs[i].ref) 的循环，但 ref=gettop+1 恒越界且多次移除后索引偏移，
// 实为死代码；末尾 lua_settop(L,0) 已完整清栈（LuaJIT 下越界 remove 会损坏内存导致崩溃，故删除）
this->pkg_cont = 0;
// 清理预加载函数
for(int i = 0; i < this->func_cont; i++)