Make CPython segfault in 5 lines of code

Re:Make CPython segfault in 5 lines of code by tom_mellior on Thursday December 19, 2019 @05:13AM (#21833532)

> In those same versions of Lua, the bytecode format is notoriously dangerous to load.

Could you expand on this? Are the dangers such that they could be avoided with a bytecode verifier somewhat like Java's? Things like checking that the stack can never underflow, and that at the merge points of branches the stack always has the same depth.

[ Parent | on HN ]

Re:Make CPython segfault in 5 lines of code by lpghatguy on Thursday December 19, 2019 @02:04PM (#21838071)

Here are two slide decks talking (roughly) about real-world attacks against Lua 5.1 and 5.2's bytecode:

5.1: https://www.lua.org/wshop11/Cawley.pdf

5.2: https://apocrypha.numin.it/talks/lua_bytecode_exploitation.p...

Lua used to have a built-in bytecode verifier as I understand it, but it never reached the point to where it was enough to safeguard the VM.

[ Parent | on HN ]