runqueue: fix use-after-free bug

[project/libubox.git] / lua / uloop.c

diff --git a/lua/uloop.c b/lua/uloop.c
index 782b5a5..1b0389f 100644 (file)
--- a/lua/uloop.c
+++ b/lua/uloop.c
@@ -94,6 +94,15 @@ static int ul_timer_set(lua_State *L)
        return 1;
 }
 
+static int ul_timer_remaining(lua_State *L)
+{
+       struct lua_uloop_timeout *tout;
+
+       tout = lua_touserdata(L, 1);
+       lua_pushnumber(L, uloop_timeout_remaining(&tout->t));
+       return 1;
+}
+
 static int ul_timer_free(lua_State *L)
 {
        struct lua_uloop_timeout *tout = lua_touserdata(L, 1);
@@ -114,6 +123,7 @@ static int ul_timer_free(lua_State *L)
 
 static const luaL_Reg timer_m[] = {
        { "set", ul_timer_set },
+       { "remaining", ul_timer_remaining },
        { "cancel", ul_timer_free },
        { NULL, NULL }
 };
@@ -278,8 +288,21 @@ static int ul_process_free(lua_State *L)
        return 1;
 }
 
+static int ul_process_pid(lua_State *L)
+{
+       struct lua_uloop_process *proc = lua_touserdata(L, 1);
+
+       if (proc->p.pid) {
+               lua_pushnumber(L, proc->p.pid);
+               return 1;
+       }
+
+       return 0;
+}
+
 static const luaL_Reg process_m[] = {
        { "delete", ul_process_free },
+       { "pid", ul_process_pid },
        { NULL, NULL }
 };
 
@@ -325,9 +348,12 @@ static int ul_process(lua_State *L)
                int argn = lua_objlen(L, -3);
                int envn = lua_objlen(L, -2);
                char** argp = malloc(sizeof(char*) * (argn + 2));
-               char** envp = malloc(sizeof(char*) * envn + 1);
+               char** envp = malloc(sizeof(char*) * (envn + 1));
                int i = 1;
 
+               if (!argp || !envp)
+                       _exit(-1);
+
                argp[0] = (char*) lua_tostring(L, -4);
                for (i = 1; i <= argn; i++) {
                        lua_rawgeti(L, -3, i);
@@ -344,7 +370,7 @@ static int ul_process(lua_State *L)
                envp[i - 1] = NULL;
 
                execve(*argp, argp, envp);
-               exit(-1);
+               _exit(-1);
        }
 
        lua_getglobal(L, "__uloop_cb");