From 310a9f39ae993dd8dc384edd22fe559e08d5bf53 Mon Sep 17 00:00:00 2001 From: Willy Tarreau Date: Thu, 6 Aug 2026 09:38:41 +0200 Subject: [PATCH] BUG/MINOR: hlua: use a local buffer to format the socket addresses hlua_socket_info() formats the peer or local address of a Lua socket into a function-static buffer shared by all threads. But there's no reason for this buffer to be static, and it can cause inter-thread corruption. Let's just drop the static modifier so that the address lies in the stack. It can be backported to all versions since it's been there since 1.6 when sockets were introduced to Lua. Reported-by: Claude (ANT-2026-W66XVDTK) --- src/hlua.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/hlua.c b/src/hlua.c index 38f82182e..1f62dc53e 100644 --- a/src/hlua.c +++ b/src/hlua.c @@ -3301,7 +3301,7 @@ static int hlua_socket_send(struct lua_State *L) #define SOCKET_INFO_MAX_LEN sizeof("[0000:0000:0000:0000:0000:0000:0000:0000]:12345") __LJMP static inline int hlua_socket_info(struct lua_State *L, const struct sockaddr_storage *addr) { - static char buffer[SOCKET_INFO_MAX_LEN]; + char buffer[SOCKET_INFO_MAX_LEN]; int ret; int len; char *p; -- 2.47.3