Skip to content

Commit

Permalink
AP_Scripting: correct use-after-free in script statistics
Browse files Browse the repository at this point in the history
run_next_script can free the script if the script runs over-time.

... so stop using data from that freed script structure!
  • Loading branch information
peterbarker committed Jun 25, 2024
1 parent a77a0c2 commit 9bb3439
Showing 1 changed file with 9 additions and 2 deletions.
11 changes: 9 additions & 2 deletions libraries/AP_Scripting/lua_scripts.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -550,8 +550,11 @@ void lua_scripts::run(void) {
if ((_debug_options.get() & uint8_t(DebugLevel::RUNTIME_MSG)) != 0) {
GCS_SEND_TEXT(MAV_SEVERITY_DEBUG, "Lua: Running %s", scripts->name);
}
// copy name for logging, cant do it after as script reschedule moves the pointers
const char * script_name = scripts->name;
// take a copy of the script name for the purposes of
// logging statistics. "scripts" may become invalid
// during the "run_next_script" call, below.
char script_name[128+1] {};
strncpy_noterm(script_name, scripts->name, 128);

#if DISABLE_INTERRUPTS_FOR_SCRIPT_RUN
void *istate = hal.scheduler->disable_interrupts_save();
Expand All @@ -560,6 +563,10 @@ void lua_scripts::run(void) {
const int startMem = lua_gc(L, LUA_GCCOUNT, 0) * 1024 + lua_gc(L, LUA_GCCOUNTB, 0);
const uint32_t loadEnd = AP_HAL::micros();

// NOTE! the base pointer of our scripts linked list,
// *and all its contents* may become invalid as part of
// "run_next_script"! So do *NOT* attempt to access
// anything that was in *scripts after this call.
run_next_script(L);

const uint32_t runEnd = AP_HAL::micros();
Expand Down

0 comments on commit 9bb3439

Please sign in to comment.