From a47f5e426702675c361eb7124b2c6434d0c65ea6 Mon Sep 17 00:00:00 2001 From: KIMDONGYEON00 Date: Tue, 14 Oct 2025 13:43:18 +0900 Subject: [PATCH 1/5] Fix lua UAF (CVE-2025-49844) Fix lua UAF bug (CVE-2025-49844 - Redishell) --- app/redis-6.2.6/deps/lua/src/lparser.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/app/redis-6.2.6/deps/lua/src/lparser.c b/app/redis-6.2.6/deps/lua/src/lparser.c index dda7488dc..ee7d90c90 100644 --- a/app/redis-6.2.6/deps/lua/src/lparser.c +++ b/app/redis-6.2.6/deps/lua/src/lparser.c @@ -384,13 +384,17 @@ Proto *luaY_parser (lua_State *L, ZIO *z, Mbuffer *buff, const char *name) { struct LexState lexstate; struct FuncState funcstate; lexstate.buff = buff; - luaX_setinput(L, &lexstate, z, luaS_new(L, name)); + TString *tname = luaS_new(L, name); + setsvalue2s(L, L->top, tname); + incr_top(L); + luaX_setinput(L, &lexstate, z, tname); open_func(&lexstate, &funcstate); funcstate.f->is_vararg = VARARG_ISVARARG; /* main func. is always vararg */ luaX_next(&lexstate); /* read first token */ chunk(&lexstate); check(&lexstate, TK_EOS); close_func(&lexstate); + --L->top; lua_assert(funcstate.prev == NULL); lua_assert(funcstate.f->nups == 0); lua_assert(lexstate.fs == NULL); From 00661724c47b811e850b8d8532ac0feb40a5848e Mon Sep 17 00:00:00 2001 From: KIMDONGYEON00 Date: Tue, 14 Oct 2025 14:00:10 +0900 Subject: [PATCH 2/5] Fix lua bit.tohex (CVE-2024-31449) Fix lua bit.tohex (CVE-2024-31449) --- app/redis-6.2.6/deps/lua/src/lua_bit.c | 1 + 1 file changed, 1 insertion(+) diff --git a/app/redis-6.2.6/deps/lua/src/lua_bit.c b/app/redis-6.2.6/deps/lua/src/lua_bit.c index 690df7d3c..a459ca98b 100644 --- a/app/redis-6.2.6/deps/lua/src/lua_bit.c +++ b/app/redis-6.2.6/deps/lua/src/lua_bit.c @@ -131,6 +131,7 @@ static int bit_tohex(lua_State *L) const char *hexdigits = "0123456789abcdef"; char buf[8]; int i; + if (n == INT32_MIN) n = INT32_MIN+1; if (n < 0) { n = -n; hexdigits = "0123456789ABCDEF"; } if (n > 8) n = 8; for (i = (int)n; --i >= 0; ) { buf[i] = hexdigits[b & 15]; b >>= 4; } From 6d75b1628eb999fcc092a32a436be1360ff78ed8 Mon Sep 17 00:00:00 2001 From: KIMDONGYEON00 Date: Mon, 20 Oct 2025 20:06:26 +0900 Subject: [PATCH 3/5] Fix Lua (CVE-2025-46819) --- app/redis-6.2.6/deps/lua/src/llex.c | 29 +++++++++++++++++------------ 1 file changed, 17 insertions(+), 12 deletions(-) diff --git a/app/redis-6.2.6/deps/lua/src/llex.c b/app/redis-6.2.6/deps/lua/src/llex.c index 88c6790c0..adcc751e6 100644 --- a/app/redis-6.2.6/deps/lua/src/llex.c +++ b/app/redis-6.2.6/deps/lua/src/llex.c @@ -138,6 +138,7 @@ static void inclinenumber (LexState *ls) { void luaX_setinput (lua_State *L, LexState *ls, ZIO *z, TString *source) { + ls->t.token = 0; ls->decpoint = '.'; ls->L = L; ls->lookahead.token = TK_EOS; /* no look-ahead token */ @@ -207,8 +208,8 @@ static void read_numeral (LexState *ls, SemInfo *seminfo) { } -static int skip_sep (LexState *ls) { - int count = 0; +static size_t skip_sep (LexState *ls) { + size_t count = 0; int s = ls->current; lua_assert(s == '[' || s == ']'); save_and_next(ls); @@ -216,11 +217,14 @@ static int skip_sep (LexState *ls) { save_and_next(ls); count++; } - return (ls->current == s) ? count : (-count) - 1; + + return (ls->current == s) ? count + 2 + : (count == 0) ? 1 + : 0; } -static void read_long_string (LexState *ls, SemInfo *seminfo, int sep) { +static void read_long_string (LexState *ls, SemInfo *seminfo, size_t sep) { int cont = 0; (void)(cont); /* avoid warnings when `cont' is not used */ save_and_next(ls); /* skip 2nd `[' */ @@ -270,8 +274,8 @@ static void read_long_string (LexState *ls, SemInfo *seminfo, int sep) { } } endloop: if (seminfo) - seminfo->ts = luaX_newstring(ls, luaZ_buffer(ls->buff) + (2 + sep), - luaZ_bufflen(ls->buff) - 2*(2 + sep)); + seminfo->ts = luaX_newstring(ls, luaZ_buffer(ls->buff) + sep, + luaZ_bufflen(ls->buff) - 2 * sep); } @@ -346,9 +350,9 @@ static int llex (LexState *ls, SemInfo *seminfo) { /* else is a comment */ next(ls); if (ls->current == '[') { - int sep = skip_sep(ls); + size_t sep = skip_sep(ls); luaZ_resetbuffer(ls->buff); /* `skip_sep' may dirty the buffer */ - if (sep >= 0) { + if (sep >= 2) { read_long_string(ls, NULL, sep); /* long comment */ luaZ_resetbuffer(ls->buff); continue; @@ -360,13 +364,14 @@ static int llex (LexState *ls, SemInfo *seminfo) { continue; } case '[': { - int sep = skip_sep(ls); - if (sep >= 0) { + size_t sep = skip_sep(ls); + if (sep >= 2) { read_long_string(ls, seminfo, sep); return TK_STRING; } - else if (sep == -1) return '['; - else luaX_lexerror(ls, "invalid long string delimiter", TK_STRING); + else if (sep == 0) /* '[=...' missing second bracket */ + luaX_lexerror(ls, "invalid long string delimiter", TK_STRING); + return '['; } case '=': { next(ls); From bdcc69de53818d058c3824a829016f2d24b552e9 Mon Sep 17 00:00:00 2001 From: KIMDONGYEON00 Date: Mon, 20 Oct 2025 20:08:12 +0900 Subject: [PATCH 4/5] Fix Lua Integer Overflow (CVE-2025-46817) --- app/redis-6.2.6/deps/lua/src/lbaselib.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/app/redis-6.2.6/deps/lua/src/lbaselib.c b/app/redis-6.2.6/deps/lua/src/lbaselib.c index 2ab550bd4..26172d15b 100644 --- a/app/redis-6.2.6/deps/lua/src/lbaselib.c +++ b/app/redis-6.2.6/deps/lua/src/lbaselib.c @@ -340,13 +340,14 @@ static int luaB_assert (lua_State *L) { static int luaB_unpack (lua_State *L) { - int i, e, n; + int i, e; + unsigned int n; luaL_checktype(L, 1, LUA_TTABLE); i = luaL_optint(L, 2, 1); e = luaL_opt(L, luaL_checkint, 3, luaL_getn(L, 1)); if (i > e) return 0; /* empty range */ - n = e - i + 1; /* number of elements */ - if (n <= 0 || !lua_checkstack(L, n)) /* n <= 0 means arith. overflow */ + n = (unsigned int)e - (unsigned int)i; /* number of elements minus 1 */ + if (n >= INT_MAX || !lua_checkstack(L, ++n)) return luaL_error(L, "too many results to unpack"); lua_rawgeti(L, 1, i); /* push arg[i] (avoiding overflow problems) */ while (i++ < e) /* push arg[i + 1...e] */ From 841897951ace776ffcb9156a94bfb46c6fe606c5 Mon Sep 17 00:00:00 2001 From: KIMDONGYEON00 Date: Mon, 20 Oct 2025 20:08:47 +0900 Subject: [PATCH 5/5] Fix Lua Integer Overflow (CVE-2025-46817) --- app/redis-6.2.6/deps/lua/src/ltable.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/redis-6.2.6/deps/lua/src/ltable.c b/app/redis-6.2.6/deps/lua/src/ltable.c index ec84f4fab..210eadf86 100644 --- a/app/redis-6.2.6/deps/lua/src/ltable.c +++ b/app/redis-6.2.6/deps/lua/src/ltable.c @@ -434,7 +434,7 @@ static TValue *newkey (lua_State *L, Table *t, const TValue *key) { */ const TValue *luaH_getnum (Table *t, int key) { /* (1 <= key && key <= t->sizearray) */ - if (cast(unsigned int, key-1) < cast(unsigned int, t->sizearray)) + if (1 <= key && key <= t->sizearray) return &t->array[key-1]; else { lua_Number nk = cast_num(key);