Re:Bytecode Breakdown: Unraveling Factorio's Lua Security Flaws
by dividuum on Saturday June 29, 2024 @11:42AM
(#40831363)
OP only refers to bytecode. There's nothing wrong with executing Lua when provided to the VM via source code. The only reason to allow the VM to load bytecode directly is 1) a very minor improvement in loading time, as the interpreter then doesn't have to parse Lua code into bytecode itself 2) allowing obfuscation of logic running within Factorio. Both seem rather irrelevant, so I'm not sure why they allow loading bytecode directly.
[ Parent
| on HN ]
Re:Bytecode Breakdown: Unraveling Factorio's Lua Security Flaws
by kfmdnfj on Monday July 01, 2024 @02:04AM
(#40842991)
Isn't hardening source code parsing much more difficult then hardening byte code parsing?
Sure, the output of the lua compiler might be guaranteed to not invoke undefined behavior in the byte code interpreter, but the compiler itself might be vulnerable.
To my knowledge, compilers like GCC and clang treat source code as trusted for this reason