lua: Patch CVE-2022-33099 (#3371)

* lua: patching CVE-2022-33099

SPECS/lua/CVE-2022-33099.patch

@@ -0,0 +1,62 @@
+From 42d40581dd919fb134c07027ca1ce0844c670daf Mon Sep 17 00:00:00 2001
+From: Roberto Ierusalimschy <roberto@inf.puc-rio.br>
+Date: Fri, 20 May 2022 13:14:33 -0300
+Subject: [PATCH] Save stack space while handling errors
+
+Because error handling (luaG_errormsg) uses slots from EXTRA_STACK,
+and some errors can recur (e.g., string overflow while creating an
+error message in 'luaG_runerror', or a C-stack overflow before calling
+the message handler), the code should use stack slots with parsimony.
+
+This commit fixes the bug "Lua-stack overflow when C stack overflows
+while handling an error".
+
+Patch taken from upstream which was applied to version 5.4.4 and adjusted for version 5.4.3.
+
+---
+ ldebug.c | 5 ++++-
+ lvm.c    | 6 ++++--
+ 2 files changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/src/ldebug.c b/src/ldebug.c
+index 1feaab2..5524fae 100644
+--- a/src/ldebug.c
++++ b/src/ldebug.c
+@@ -783,8 +783,11 @@ l_noret luaG_runerror (lua_State *L, const char *fmt, ...) {
+   va_start(argp, fmt);
+   msg = luaO_pushvfstring(L, fmt, argp);  /* format message */
+   va_end(argp);
+-  if (isLua(ci))  /* if Lua function, add source:line information */
++  if (isLua(ci)) {  /* if Lua function, add source:line information */
+     luaG_addinfo(L, msg, ci_func(ci)->p->source, getcurrentline(ci));
++    setobjs2s(L, L->top - 2, L->top - 1);  /* remove 'msg' from the stack */
++    L->top--;
++  }
+   luaG_errormsg(L);
+ }
+ 
+diff --git a/src/lvm.c b/src/lvm.c
+index c9729bc..51b9614 100644
+--- a/src/lvm.c
++++ b/src/lvm.c
+@@ -656,8 +656,10 @@ void luaV_concat (lua_State *L, int total) {
+       /* collect total length and number of strings */
+       for (n = 1; n < total && tostring(L, s2v(top - n - 1)); n++) {
+         size_t l = vslen(s2v(top - n - 1));
+-        if (l_unlikely(l >= (MAX_SIZE/sizeof(char)) - tl))
++        if (l_unlikely(l >= (MAX_SIZE/sizeof(char)) - tl)) {
++          L->top = top - total;  /* pop strings to avoid wasting stack */
+           luaG_runerror(L, "string length overflow");
++        }
+         tl += l;
+       }
+       if (tl <= LUAI_MAXSHORTLEN) {  /* is result a short string? */
+@@ -672,7 +674,7 @@ void luaV_concat (lua_State *L, int total) {
+       setsvalue2s(L, top - n, ts);  /* create result */
+     }
+     total -= n-1;  /* got 'n' strings to create 1 new */
+-    L->top -= n-1;  /* popped 'n' strings and pushed one */
++    L->top = top - (n - 1);  /* popped 'n' strings and pushed one */
+   } while (total > 1);  /* repeat until only 1 result left */
+ }
+

SPECS/lua/lua.spec

@@ -14,7 +14,7 @@
 Summary:        Powerful light-weight programming language
 Name:           lua
 Version:        %{major_version}.3
-Release:        3%{?dist}
+Release:        4%{?dist}
 License:        MIT
 Vendor:         Microsoft Corporation
 Distribution:   Mariner
@@ -44,6 +44,7 @@ Patch19:        %{name}-5.4.3-bug3.patch
 Patch20:        CVE-2021-43519.patch
 Patch21:        CVE-2022-28805.patch
 Patch22:        CVE-2021-44647.patch
+Patch23:        CVE-2022-33099.patch
 
 BuildRequires:  autoconf
 BuildRequires:  automake
@@ -219,6 +220,9 @@ popd
 %{_libdir}/*.a
 
 %changelog
+* Wed Jul 13 2022 Mandeep Plaha <mandeepplaha@microsoft.com> - 5.4.3-4
+- Patching CVE-2022-33099.
+
 * Tue Jun 07 2022 Pawel Winogrodzki <pawelwi@microsoft.com> - 5.4.3-3
 - Patching CVE-2021-44647.
 

toolkit/resources/manifests/package/pkggen_core_aarch64.txt

@@ -205,8 +205,8 @@ libltdl-2.4.6-8.cm2.aarch64.rpm
 libltdl-devel-2.4.6-8.cm2.aarch64.rpm
 pcre-8.45-2.cm2.aarch64.rpm
 pcre-libs-8.45-2.cm2.aarch64.rpm
-lua-5.4.3-3.cm2.aarch64.rpm
-lua-libs-5.4.3-3.cm2.aarch64.rpm
+lua-5.4.3-4.cm2.aarch64.rpm
+lua-libs-5.4.3-4.cm2.aarch64.rpm
 mariner-rpm-macros-2.0-16.cm2.noarch.rpm
 mariner-check-macros-2.0-16.cm2.noarch.rpm
 libassuan-2.5.5-2.cm2.aarch64.rpm

toolkit/resources/manifests/package/pkggen_core_x86_64.txt

@@ -205,8 +205,8 @@ libltdl-2.4.6-8.cm2.x86_64.rpm
 libltdl-devel-2.4.6-8.cm2.x86_64.rpm
 pcre-8.45-2.cm2.x86_64.rpm
 pcre-libs-8.45-2.cm2.x86_64.rpm
-lua-5.4.3-3.cm2.x86_64.rpm
-lua-libs-5.4.3-3.cm2.x86_64.rpm
+lua-5.4.3-4.cm2.x86_64.rpm
+lua-libs-5.4.3-4.cm2.x86_64.rpm
 mariner-rpm-macros-2.0-16.cm2.noarch.rpm
 mariner-check-macros-2.0-16.cm2.noarch.rpm
 libassuan-2.5.5-2.cm2.x86_64.rpm

toolkit/resources/manifests/package/toolchain_aarch64.txt

@@ -209,13 +209,13 @@ libxml2-devel-2.9.14-1.cm2.aarch64.rpm
 libxslt-1.1.34-7.cm2.aarch64.rpm
 libxslt-debuginfo-1.1.34-7.cm2.aarch64.rpm
 libxslt-devel-1.1.34-7.cm2.aarch64.rpm
-lua-5.4.3-3.cm2.aarch64.rpm
-lua-debuginfo-5.4.3-3.cm2.aarch64.rpm
-lua-devel-5.4.3-3.cm2.aarch64.rpm
-lua-libs-5.4.3-3.cm2.aarch64.rpm
+lua-5.4.3-4.cm2.aarch64.rpm
+lua-debuginfo-5.4.3-4.cm2.aarch64.rpm
+lua-devel-5.4.3-4.cm2.aarch64.rpm
+lua-libs-5.4.3-4.cm2.aarch64.rpm
 lua-rpm-macros-1-6.cm2.noarch.rpm
 lua-srpm-macros-1-6.cm2.noarch.rpm
-lua-static-5.4.3-3.cm2.aarch64.rpm
+lua-static-5.4.3-4.cm2.aarch64.rpm
 lz4-1.9.3-1.cm2.aarch64.rpm
 lz4-debuginfo-1.9.3-1.cm2.aarch64.rpm
 lz4-devel-1.9.3-1.cm2.aarch64.rpm

toolkit/resources/manifests/package/toolchain_x86_64.txt

@@ -209,13 +209,13 @@ libxml2-devel-2.9.14-1.cm2.x86_64.rpm
 libxslt-1.1.34-7.cm2.x86_64.rpm
 libxslt-debuginfo-1.1.34-7.cm2.x86_64.rpm
 libxslt-devel-1.1.34-7.cm2.x86_64.rpm
-lua-5.4.3-3.cm2.x86_64.rpm
-lua-debuginfo-5.4.3-3.cm2.x86_64.rpm
-lua-devel-5.4.3-3.cm2.x86_64.rpm
-lua-libs-5.4.3-3.cm2.x86_64.rpm
+lua-5.4.3-4.cm2.x86_64.rpm
+lua-debuginfo-5.4.3-4.cm2.x86_64.rpm
+lua-devel-5.4.3-4.cm2.x86_64.rpm
+lua-libs-5.4.3-4.cm2.x86_64.rpm
 lua-rpm-macros-1-6.cm2.noarch.rpm
 lua-srpm-macros-1-6.cm2.noarch.rpm
-lua-static-5.4.3-3.cm2.x86_64.rpm
+lua-static-5.4.3-4.cm2.x86_64.rpm
 lz4-1.9.3-1.cm2.x86_64.rpm
 lz4-debuginfo-1.9.3-1.cm2.x86_64.rpm
 lz4-devel-1.9.3-1.cm2.x86_64.rpm