[tarantool-patches] [PATCH v3 1/2] lua-yaml: verify arguments count

[Alexander Turenko]

From: AKhatskevich <avkhatskevich at tarantool.org>

Added arguments count check for yaml.encode() and yaml.decode()
functions.

Without these checks the functions could read garbage outside of a Lua
stack when called w/o arguments.
---
 test/app-tap/yaml.test.lua    | 74 ++++++++++++++++++++++++++++++++++-
 third_party/lua-yaml/lyaml.cc |  7 ++--
 2 files changed, 77 insertions(+), 4 deletions(-)

diff --git a/test/app-tap/yaml.test.lua b/test/app-tap/yaml.test.lua
index 4784bb27d..b9bb10720 100755
--- a/test/app-tap/yaml.test.lua
+++ b/test/app-tap/yaml.test.lua
@@ -130,9 +130,80 @@ local function test_tagged(test, s)
             "tag prefix on multiple documents")
 end
 
+local function test_api(test, s)
+    local encode_usage = 'Usage: encode(object, {tag_prefix = <string>, ' ..
+        'tag_handle = <string>})'
+    local decode_usage = 'Usage: yaml.decode(document, [{tag_only = boolean}])'
+
+    local cases = {
+        {
+            'encode: no args',
+            func = s.encode,
+            args = {},
+            exp_err = encode_usage,
+        },
+        {
+            'encode: wrong opts',
+            func = s.encode,
+            args = {{}, 1},
+            exp_err = encode_usage,
+        },
+        {
+            'encode: wrong tag_prefix',
+            func = s.encode,
+            args = {{}, {tag_prefix = 1}},
+            exp_err = encode_usage,
+        },
+        {
+            'encode: wrong tag_handle',
+            func = s.encode,
+            args = {{}, {tag_handle = 1}},
+            exp_err = encode_usage,
+        },
+        {
+            'encode: extra args',
+            func = s.encode,
+            args = {{}, {}, {}},
+            exp_err = encode_usage,
+        },
+        {
+            'decode: no args',
+            func = s.decode,
+            args = {},
+            exp_err = decode_usage,
+        },
+        {
+            'decode: wrong input',
+            func = s.decode,
+            args = {true},
+            exp_err = decode_usage,
+        },
+        {
+            'decode: wrong opts',
+            func = s.decode,
+            args = {'', 1},
+            exp_err = decode_usage,
+        },
+        {
+            'decode: extra args',
+            func = s.decode,
+            args = {'', nil, {}},
+            exp_err = decode_usage,
+        },
+    }
+
+    test:plan(#cases)
+
+    for _, case in ipairs(cases) do
+        local args_len = table.maxn(case.args)
+        local ok, err = pcall(case.func, unpack(case.args, 1, args_len))
+        test:is_deeply({ok, err}, {false, case.exp_err}, case[1])
+    end
+end
+
 tap.test("yaml", function(test)
     local serializer = require('yaml')
-    test:plan(11)
+    test:plan(12)
     test:test("unsigned", common.test_unsigned, serializer)
     test:test("signed", common.test_signed, serializer)
     test:test("double", common.test_double, serializer)
@@ -144,4 +215,5 @@ tap.test("yaml", function(test)
     test:test("compact", test_compact, serializer)
     test:test("output", test_output, serializer)
     test:test("tagged", test_tagged, serializer)
+    test:test("api", test_api, serializer)
 end)
diff --git a/third_party/lua-yaml/lyaml.cc b/third_party/lua-yaml/lyaml.cc
index c6d118a79..354cafe86 100644
--- a/third_party/lua-yaml/lyaml.cc
+++ b/third_party/lua-yaml/lyaml.cc
@@ -400,7 +400,8 @@ static void load(struct lua_yaml_loader *loader) {
  */
 static int l_load(lua_State *L) {
    struct lua_yaml_loader loader;
-   if (! lua_isstring(L, 1)) {
+   int top = lua_gettop(L);
+   if (!(top == 1 || top == 2) || !lua_isstring(L, 1)) {
 usage_error:
       return luaL_error(L, "Usage: yaml.decode(document, "\
                         "[{tag_only = boolean}])");
@@ -416,7 +417,7 @@ usage_error:
       return luaL_error(L, OOM_ERRMSG);
    yaml_parser_set_input_string(&loader.parser, (yaml_char_t *) document, len);
    bool tag_only;
-   if (lua_gettop(L) > 1) {
+   if (lua_gettop(L) == 2 && ! lua_isnil(L, 2)) {
       if (! lua_istable(L, 2))
          goto usage_error;
       lua_getfield(L, 2, "tag_only");
@@ -794,7 +795,7 @@ error:
 static int l_dump(lua_State *L) {
    struct luaL_serializer *serializer = luaL_checkserializer(L);
    int top = lua_gettop(L);
-   if (top > 2) {
+   if (!(top == 1 || top == 2)) {
 usage_error:
       return luaL_error(L, "Usage: encode(object, {tag_prefix = <string>, "\
                         "tag_handle = <string>})");
-- 
2.20.1