Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Here is a negation overflow in lua #3627

Closed
Crispy-fried-chicken opened this issue Feb 3, 2024 · 2 comments
Closed

Here is a negation overflow in lua #3627

Crispy-fried-chicken opened this issue Feb 3, 2024 · 2 comments

Comments

@Crispy-fried-chicken
Copy link
Contributor

CVE-2020-24370 is a security vulnerability in lua. Although the CVE decription in CVE-2020-24370 said that this CVE only affected lua 5.4.0, according to lua this CVE actually existed since lua 5.2. The root cause of this CVE is the negation overflow that occurs when you try to take the negative of 0x80000000. Thus, this CVE also exists in nodemcu-firmware in the file app/lua53/ldebug.c.
Maybe you should try to backport the fix to the lua in nodemcu-firmwaresince the original fix is for 5.4 and several functions need to be changed. I'd like to open a PR for that if necessary.

@pjsg
Copy link
Member

pjsg commented Feb 4, 2024

Please open a PR for that.

@Crispy-fried-chicken
Copy link
Contributor Author

Please open a PR for that.

Sure, I've already opened, which is #3632, please check it, thank you!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants