[jira] [Comment Edited] (JEXL-405) Recursive functions corrupt evaluation frame if reassigned

["Henri Biestro (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/JEXL-405?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17761055#comment-17761055 ] 

Henri Biestro edited comment on JEXL-405 at 9/1/23 3:16 PM:
------------------------------------------------------------

The fix ensures that the lambda frame is only updated during its creation/assignment by checking that the caller's scope is indeed the lambda's scope parent.

Many thanks to VincentB for reporting and analyzing this.

Commit [53eb3db|https://github.com/apache/commons-jexl/commit/53eb3dbd42d27ba5411197f024ce9ddf2c1bcca]


was (Author: henrib):
The fix ensures that the lambda frame is only updated during its creation/assignment by checking that the caller's scope is indeed the lambda's scope parent.

Commit [53eb3db|https://github.com/apache/commons-jexl/commit/53eb3dbd42d27ba5411197f024ce9ddf2c1bcca]

> Recursive functions corrupt evaluation frame if reassigned
> ----------------------------------------------------------
>
>                 Key: JEXL-405
>                 URL: https://issues.apache.org/jira/browse/JEXL-405
>             Project: Commons JEXL
>          Issue Type: Bug
>    Affects Versions: 3.3
>            Reporter: Henri Biestro
>            Assignee: Henri Biestro
>            Priority: Major
>             Fix For: 3.3.1
>
>
> This issue stems from the special handling recursive functions. A recursive function is detected when a lambda is created and assigned to a variable and that variable is captured by the lambda. During the assignment, the lambda frame - the captured value for the lambda symbol in that frame - is updated with a reference to the lambda itself. This can only occur after the lambda is created (obviously).
> The code that handles the special case during assignment does not verify that the caller is indeed its creator frame. Thus, if the lambda is assigned to a different variable later on in a different scope, that same code will trash the frame with a reference to the lambda...



--
This message was sent by Atlassian Jira
(v8.20.10#820010)