[Tarantool-patches] [PATCH v1 1/1] box: check STRING length when it is cast to UUID

[Serge Petrenko]

04.06.2021 13:23, Mergen Imeev пишет:
> Hi! Thank you for the review! My answer, diff and new patch below.

Thanks for the fix! LGTM.
>
> On Fri, Jun 04, 2021 at 12:57:34PM +0300, Serge Petrenko wrote:
>>
>> 03.06.2021 18:54, imeevma at tarantool.org пишет:
>>> After this patch, the tt_uuid_from_strl() function will check the length
>>> of the given string before converting it to a UUID.
>>>
>>> Follow up #5886
>> Hi! Thanks for the patch!
>> Please, find one comment below.
>>
>>> ---
>>> https://github.com/tarantool/tarantool/issues/5886
>>> https://github.com/tarantool/tarantool/tree/imeevma/gh-5886-follow-up
>>>
>>>    src/lib/uuid/tt_uuid.c     |  2 ++
>>>    test/sql-tap/uuid.test.lua | 19 ++++++++++++++++++-
>>>    2 files changed, 20 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/src/lib/uuid/tt_uuid.c b/src/lib/uuid/tt_uuid.c
>>> index 8bc9bc7af..6bdf2014a 100644
>>> --- a/src/lib/uuid/tt_uuid.c
>>> +++ b/src/lib/uuid/tt_uuid.c
>>> @@ -98,6 +98,8 @@ tt_uuid_str(const struct tt_uuid *uu)
>>>    int
>>>    tt_uuid_from_strl(const char *in, size_t len, struct tt_uuid *uu)
>>>    {
>>> +	if (len != UUID_STR_LEN)
>>> +		return -1;
>> tt_uuid_from_string() returns '1' in case of an error, so let's stay
>> consistent here.
>>
> Thanks, fixed.
>
>>>    	char buf[UUID_STR_LEN + 1];
>>>    	snprintf(buf, sizeof(buf), "%.*s", (int) len, in);
>>>    	return tt_uuid_from_string(buf, uu);
>>> diff --git a/test/sql-tap/uuid.test.lua b/test/sql-tap/uuid.test.lua
>>> index 83fcc3d0e..77ba06c2d 100755
>>> --- a/test/sql-tap/uuid.test.lua
>>> +++ b/test/sql-tap/uuid.test.lua
>>> @@ -3,7 +3,7 @@ local build_path = os.getenv("BUILDDIR")
>>>    package.cpath = build_path..'/test/sql-tap/?.so;'..build_path..'/test/sql-tap/?.dylib;'..package.cpath
>>>    local test = require("sqltester")
>>> -test:plan(145)
>>> +test:plan(147)
>>>    local uuid = require("uuid")
>>>    local uuid1 = uuid.fromstr("11111111-1111-1111-1111-111111111111")
>>> @@ -1316,6 +1316,23 @@ test:do_execsql_test(
>>>            true
>>>        })
>>> +-- Make sure STRING of wrong length cannot be cast to UUID.
>>> +test:do_catchsql_test(
>>> +    "uuid-17.1",
>>> +    [[
>>> +        SELECT CAST('11111111-1111-1111-1111-111111111111111222222222' AS UUID);
>>> +    ]], {
>>> +        1, "Type mismatch: can not convert 11111111-1111-1111-1111-111111111111111222222222 to uuid"
>>> +    })
>>> +
>>> +test:do_catchsql_test(
>>> +    "uuid-17.2",
>>> +    [[
>>> +        SELECT CAST('11111111-1111-1111-1111-11111' AS UUID);
>>> +    ]], {
>>> +        1, "Type mismatch: can not convert 11111111-1111-1111-1111-11111 to uuid"
>>> +    })
>>> +
>>>    test:execsql([[
>>>        DROP TRIGGER t;
>>>        DROP VIEW v;
>> -- 
>> Serge Petrenko
>>
>
> Diff:
>
> diff --git a/src/lib/uuid/tt_uuid.c b/src/lib/uuid/tt_uuid.c
> index 6bdf2014a..d92376650 100644
> --- a/src/lib/uuid/tt_uuid.c
> +++ b/src/lib/uuid/tt_uuid.c
> @@ -99,7 +99,7 @@ int
>   tt_uuid_from_strl(const char *in, size_t len, struct tt_uuid *uu)
>   {
>   	if (len != UUID_STR_LEN)
> -		return -1;
> +		return 1;
>   	char buf[UUID_STR_LEN + 1];
>   	snprintf(buf, sizeof(buf), "%.*s", (int) len, in);
>   	return tt_uuid_from_string(buf, uu);
>
> Patch:
>
> commit 914c02c99c616bef3d5ff87306c79a7921dfeec7
> Author: Mergen Imeev <imeevma at gmail.com>
> Date:   Thu Jun 3 15:41:03 2021 +0300
>
>      box: check STRING length when it is cast to UUID
>      
>      After this patch, the tt_uuid_from_strl() function will check the length
>      of the given string before converting it to a UUID.
>      
>      Follow up #5886
>
> diff --git a/src/lib/uuid/tt_uuid.c b/src/lib/uuid/tt_uuid.c
> index 8bc9bc7af..d92376650 100644
> --- a/src/lib/uuid/tt_uuid.c
> +++ b/src/lib/uuid/tt_uuid.c
> @@ -98,6 +98,8 @@ tt_uuid_str(const struct tt_uuid *uu)
>   int
>   tt_uuid_from_strl(const char *in, size_t len, struct tt_uuid *uu)
>   {
> +	if (len != UUID_STR_LEN)
> +		return 1;
>   	char buf[UUID_STR_LEN + 1];
>   	snprintf(buf, sizeof(buf), "%.*s", (int) len, in);
>   	return tt_uuid_from_string(buf, uu);
> diff --git a/test/sql-tap/uuid.test.lua b/test/sql-tap/uuid.test.lua
> index 83fcc3d0e..77ba06c2d 100755
> --- a/test/sql-tap/uuid.test.lua
> +++ b/test/sql-tap/uuid.test.lua
> @@ -3,7 +3,7 @@ local build_path = os.getenv("BUILDDIR")
>   package.cpath = build_path..'/test/sql-tap/?.so;'..build_path..'/test/sql-tap/?.dylib;'..package.cpath
>   
>   local test = require("sqltester")
> -test:plan(145)
> +test:plan(147)
>   
>   local uuid = require("uuid")
>   local uuid1 = uuid.fromstr("11111111-1111-1111-1111-111111111111")
> @@ -1316,6 +1316,23 @@ test:do_execsql_test(
>           true
>       })
>   
> +-- Make sure STRING of wrong length cannot be cast to UUID.
> +test:do_catchsql_test(
> +    "uuid-17.1",
> +    [[
> +        SELECT CAST('11111111-1111-1111-1111-111111111111111222222222' AS UUID);
> +    ]], {
> +        1, "Type mismatch: can not convert 11111111-1111-1111-1111-111111111111111222222222 to uuid"
> +    })
> +
> +test:do_catchsql_test(
> +    "uuid-17.2",
> +    [[
> +        SELECT CAST('11111111-1111-1111-1111-11111' AS UUID);
> +    ]], {
> +        1, "Type mismatch: can not convert 11111111-1111-1111-1111-11111 to uuid"
> +    })
> +
>   test:execsql([[
>       DROP TRIGGER t;
>       DROP VIEW v;

-- 
Serge Petrenko