hlua_socket_info() formats the peer or local address of a Lua socket into
a function-static buffer shared by all threads. But there's no reason for
this buffer to be static, and it can cause inter-thread corruption. Let's
just drop the static modifier so that the address lies in the stack.
It can be backported to all versions since it's been there since 1.6
when sockets were introduced to Lua.
Reported-by: Claude (ANT-2026-W66XVDTK)
#define SOCKET_INFO_MAX_LEN sizeof("[0000:0000:0000:0000:0000:0000:0000:0000]:12345")
__LJMP static inline int hlua_socket_info(struct lua_State *L, const struct sockaddr_storage *addr)
{
- static char buffer[SOCKET_INFO_MAX_LEN];
+ char buffer[SOCKET_INFO_MAX_LEN];
int ret;
int len;
char *p;