<!DOCTYPE html>
<html data-lt-installed="true">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body style="padding-bottom: 1px;">
<p>Hello, Sergey,</p>
<p>thanks for the patch! LGTM</p>
<p>Sergey</p>
<div class="moz-cite-prefix">On 7/20/26 15:59, Sergey Kaplun wrote:<br>
</div>
<blockquote type="cite"
cite="mid:20260720125943.2531443-1-skaplun@tarantool.org">
<pre wrap="" class="moz-quote-pre">From: Mike Pall <mike>
Reported by Huang Haiyang.
(cherry picked from commit e4c7d8b38040518d42599eef8ddb5e67aa967a9c)
The bitfield of packed structure uses the original type size, which
leads to heap-buffer-overflow access on conversions.
This patch fixes it by adjusting the size of the bitfield container when
necessary.
Sergey Kaplun:
* added the description and the test for the problem
Part of tarantool/tarantool#12880
---
Branch: <a class="moz-txt-link-freetext" href="https://github.com/tarantool/luajit/tree/skaplun/lj-1451-ffi-packed-bitfield">https://github.com/tarantool/luajit/tree/skaplun/lj-1451-ffi-packed-bitfield</a>
Related issues:
* <a class="moz-txt-link-freetext" href="https://github.com/LuaJIT/LuaJIT/issues/1451">https://github.com/LuaJIT/LuaJIT/issues/1451</a>
* <a class="moz-txt-link-freetext" href="https://github.com/tarantool/tarantool/issues/12880">https://github.com/tarantool/tarantool/issues/12880</a>
src/lj_cparse.c | 2 ++
.../lj-1451-ffi-packed-bitfield.test.lua | 28 +++++++++++++++++++
2 files changed, 30 insertions(+)
create mode 100644 test/tarantool-tests/lj-1451-ffi-packed-bitfield.test.lua
diff --git a/src/lj_cparse.c b/src/lj_cparse.c
index ff23b44b..1b3ce7ec 100644
--- a/src/lj_cparse.c
+++ b/src/lj_cparse.c
@@ -1341,6 +1341,8 @@ static void cp_struct_layout(CPState *cp, CTypeID sid, CTInfo sattr)
CTALIGN(lj_fls(sz));
ct->size = (bofs >> 3); /* Store field offset. */
} else {
+ if (csz > amask+1 && bsz <= amask+1)
+ csz = amask+1; /* Shrink container of packed bitfield. */
ct->info = CTINFO(CT_BITFIELD,
(info & (CTF_QUAL|CTF_UNSIGNED|CTF_BOOL)) +
(csz << (CTSHIFT_BITCSZ-3)) + (bsz << CTSHIFT_BITBSZ));
diff --git a/test/tarantool-tests/lj-1451-ffi-packed-bitfield.test.lua b/test/tarantool-tests/lj-1451-ffi-packed-bitfield.test.lua
new file mode 100644
index 00000000..07e53f76
--- /dev/null
+++ b/test/tarantool-tests/lj-1451-ffi-packed-bitfield.test.lua
@@ -0,0 +1,28 @@
+local tap = require('tap')
+
+-- Test file to demonstrate LuaJIT's incorrect behaviour of the
+-- `#pragma` pack directive for bitfields in structures.
+-- See also: <a class="moz-txt-link-freetext" href="https://github.com/LuaJIT/LuaJIT/issues/1451">https://github.com/LuaJIT/LuaJIT/issues/1451</a>.
+
+local test = tap.test('lj-1451-ffi-packed-bitfield')
+
+local ffi = require('ffi')
+
+ffi.cdef[[
+#pragma pack(push, 2)
+typedef struct {
+ unsigned int <a class="moz-txt-link-freetext" href="bitfield:1">bitfield:1</a>;
+} packed_struct;
+#pragma pack(pop)
+]]
+
+test:plan(2)
+
+local packed = ffi.new('packed_struct')
+
+test:is(packed.bitfield, 0, 'correct 0-initialization')
+
+packed.bitfield = 1
+test:is(packed.bitfield, 1, 'bitfield set correctly')
+
+test:done(true)
</pre>
</blockquote>
</body>
<lt-container></lt-container>
</html>