[tarantool-patches] Re: [PATCH v2 1/3] lua-yaml: verify arguments count

[Alexander Turenko]

Hi!

See answers below.

I'll send the updated patchset as v3 soon.

WBR, Alexander Turenko.

On Fri, Jan 25, 2019 at 12:26:53AM +0300, Vladislav Shpilevoy wrote:
> Thanks for the patch!
> 
> On 22/01/2019 05:12, Alexander Turenko wrote:
> > From: AKhatskevich <avkhatskevich at tarantool.org>
> > 
> > Added arguments count check for yaml.encode() and decode.decode()
> 
> Typo: 'decode.decode' -> 'yaml.decode'.

Thx. Fixed.

> 
> > functions.
> > 
> > Without these checks the functions could read garbage outside of a Lua
> > stack when called w/o arguments.
> 
> Honestly, I do not understand how is it possible. Please,
> provide a test for both functions. See my 3 doubts below.

lua_isstring(L, 1) checks a garbage w/o preliminary lua_gettop() check.
yaml.encode() gives me "unsupported Lua type 'thread'" on the current
tarantool 2.1.

Anyway, added bad API usage test cases. Also I changed this:

diff --git a/third_party/lua-yaml/lyaml.cc b/third_party/lua-yaml/lyaml.cc
index 3a427263e..46374970f 100644
--- a/third_party/lua-yaml/lyaml.cc
+++ b/third_party/lua-yaml/lyaml.cc
@@ -453,7 +453,7 @@ usage_error:
       return luaL_error(L, OOM_ERRMSG);
    yaml_parser_set_input_string(&loader.parser, (yaml_char_t *) document, len);
    bool tag_only;
-   if (lua_gettop(L) == 2) {
+   if (lua_gettop(L) == 2 && ! lua_isnil(L, 2)) {
       if (! lua_istable(L, 2))
          goto usage_error;
       lua_getfield(L, 2, "tag_only");

We should not raise an usage error for yaml.decode(object, nil).

> 
> > ---
> >   third_party/lua-yaml/lyaml.cc | 7 ++++---
> >   1 file changed, 4 insertions(+), 3 deletions(-)
> > 
> > diff --git a/third_party/lua-yaml/lyaml.cc b/third_party/lua-yaml/lyaml.cc
> > index c6d118a79..9b07992d8 100644
> > --- a/third_party/lua-yaml/lyaml.cc
> > +++ b/third_party/lua-yaml/lyaml.cc
> > @@ -400,7 +400,8 @@ static void load(struct lua_yaml_loader *loader) {
> >    */
> >   static int l_load(lua_State *L) {
> >      struct lua_yaml_loader loader;
> > -   if (! lua_isstring(L, 1)) {
> > +   int top = lua_gettop(L);
> > +   if (!(top == 1 || top == 2) || !lua_isstring(L, 1)) {
> 
> 1. How could the old code lead to a bug, if there was a
> check if the first argument is a string? The second argument

It does not check a stack top (arguments count).

> is not used until the next hunk, about which see my next
> comment

As I see it is usual way to write such functions: check whether count of
arguments and types of mandatory arguments are valid at start of the
function.

> 
> >   usage_error:
> >         return luaL_error(L, "Usage: yaml.decode(document, "\
> >                           "[{tag_only = boolean}])");
> > @@ -416,7 +417,7 @@ usage_error:
> >         return luaL_error(L, OOM_ERRMSG);
> >      yaml_parser_set_input_string(&loader.parser, (yaml_char_t *) document, len);
> >      bool tag_only;
> > -   if (lua_gettop(L) > 1) {
> > +   if (lua_gettop(L) == 2) {
> 
> 2. This function never touches anything beyond second value on
> the stack, so here lua_gettop(L) > 1 means the same as
> lua_gettop(L) == 2 - the second argument exist. Third and next
> values do not matter.

I read this as 'those are equivalent' (correct me if I'm wrong). Ok. I'd
prefer to leave it with ==. Also note the fix I pasted above.

> 
> >         if (! lua_istable(L, 2))
> >            goto usage_error;
> >         lua_getfield(L, 2, "tag_only");
> > @@ -794,7 +795,7 @@ error:
> >   static int l_dump(lua_State *L) {
> >      struct luaL_serializer *serializer = luaL_checkserializer(L);
> >      int top = lua_gettop(L);
> > -   if (top > 2) {
> > +   if (!(top == 1 || top == 2)) {
> 
> 3. Here my reasoning is the same - the previous checking works
> as well.

It will not give an error in case of yaml.encode() and yaml.encode({},
{}, {}).

> 
> >   usage_error:
> >         return luaL_error(L, "Usage: encode(object, {tag_prefix = <string>, "\
> >                           "tag_handle = <string>})");
> >