Node.js has just released fixes for 10 security vulnerabilities that could put node-powered applications at risk and is urging everyone to update their systems.
Node.js has just released fixes for 10 security vulnerabilities that could put node-powered applications at risk and is urging everyone to update their systems.
What about Lua? https://hachyderm.io/@ell1e/117480515499692140 I think e.g. nginx and OpenDKIM have Lua scripting integrations.
Depends on how you handle the OOM error though, aborting the process is fine while “try to recover and continue” is the problem.
In lua you will typically lua_pcall() the entry function written in Lua, but it will often call back into your C functions to do various tasks. Now if your C functions do anything with the lua stack, that might cause OOM, but now your lua_pcall() will catch that - or any sort of error catching inside Lua itself - and you’ll be looking at an accidental recovery situation.
At least that was how things looked like when I last poked around Lua a few months ago.
So as far as I know, it’s actually not trivial to make Lua safely abort on OOM, and it’s not the default behavior. I also don’t think there are lua_push* function alternatives available using the default C API that don’t longjmp in a likely often unsafe manner out of your C code if you use them and you hit OOM.
Summed up, I would expect many Lua integrations to have the same problem.