[Tarantool-patches] [PATCH] Stack use after scope

[Tarantool-patches] [PATCH] Stack use after scope

[Maria]

Json decode method allocated serializer struct on stack and referenced
it after scope.

Thanks to @Korablev77 for the initial investigation.

Closes #4637
---
 third_party/lua-cjson/lua_cjson.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/third_party/lua-cjson/lua_cjson.c b/third_party/lua-cjson/lua_cjson.c
index 3d7edbf28..3d25814f3 100644
--- a/third_party/lua-cjson/lua_cjson.c
+++ b/third_party/lua-cjson/lua_cjson.c
@@ -1005,10 +1005,10 @@ static int json_decode(lua_State *l)
                   "expected 1 or 2 arguments");
 
     if (lua_gettop(l) == 2) {
-        struct luaL_serializer user_cfg = *luaL_checkserializer(l);
-        luaL_serializer_parse_options(l, &user_cfg);
+        struct luaL_serializer *user_cfg = luaL_checkserializer(l);
+        luaL_serializer_parse_options(l, user_cfg);
         lua_pop(l, 1);
-        json.cfg = &user_cfg;
+        json.cfg = user_cfg;
     } else {
         json.cfg = luaL_checkserializer(l);
     }
-- 
2.20.1 (Apple Git-117)

Re: [Tarantool-patches] [PATCH] Stack use after scope

[Maria Khaydich]

[-- Attachment #1: Type: text/plain, Size: 1371 bytes --]


Missed something.
 
Issue:
https://github.com/tarantool/tarantool/issues/4637
Branch:
https://github.com/tarantool/tarantool/compare/eljashm/gh-4637-json-stack-use-after-scope
  
>Суббота, 30 ноября 2019, 0:36 +03:00 от Maria <maria.khaydich@tarantool.org>:
> 
>Json decode method allocated serializer struct on stack and referenced
>it after scope.
>
>Thanks to @Korablev77 for the initial investigation.
>
>Closes #4637
>---
> third_party/lua-cjson/lua_cjson.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
>diff --git a/third_party/lua-cjson/lua_cjson.c b/third_party/lua-cjson/lua_cjson.c
>index 3d7edbf28..3d25814f3 100644
>--- a/third_party/lua-cjson/lua_cjson.c
>+++ b/third_party/lua-cjson/lua_cjson.c
>@@ -1005,10 +1005,10 @@ static int json_decode(lua_State *l)
>                   "expected 1 or 2 arguments");
> 
>     if (lua_gettop(l) == 2) {
>- struct luaL_serializer user_cfg = *luaL_checkserializer(l);
>- luaL_serializer_parse_options(l, &user_cfg);
>+ struct luaL_serializer *user_cfg = luaL_checkserializer(l);
>+ luaL_serializer_parse_options(l, user_cfg);
>         lua_pop(l, 1);
>- json.cfg = &user_cfg;
>+ json.cfg = user_cfg;
>     } else {
>         json.cfg = luaL_checkserializer(l);
>     }
>--
>2.20.1 (Apple Git-117)
>  
 
 
--
Maria Khaydich
 

[-- Attachment #2: Type: text/html, Size: 2405 bytes --]

Re: [Tarantool-patches] [PATCH] Stack use after scope

[Nikita Pettik]

On 30 Nov 00:36, Maria wrote:
> Json decode method allocated serializer struct on stack and referenced
> it after scope.
> 
> Thanks to @Korablev77 for the initial investigation.

A bit extended commit message and pushed to master and backported
to 1.10 and 2.2 as obvious.
 
> Closes #4637
> ---
>  third_party/lua-cjson/lua_cjson.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/third_party/lua-cjson/lua_cjson.c b/third_party/lua-cjson/lua_cjson.c
> index 3d7edbf28..3d25814f3 100644
> --- a/third_party/lua-cjson/lua_cjson.c
> +++ b/third_party/lua-cjson/lua_cjson.c
> @@ -1005,10 +1005,10 @@ static int json_decode(lua_State *l)
>                    "expected 1 or 2 arguments");
>  
>      if (lua_gettop(l) == 2) {
> -        struct luaL_serializer user_cfg = *luaL_checkserializer(l);
> -        luaL_serializer_parse_options(l, &user_cfg);
> +        struct luaL_serializer *user_cfg = luaL_checkserializer(l);
> +        luaL_serializer_parse_options(l, user_cfg);
>          lua_pop(l, 1);
> -        json.cfg = &user_cfg;
> +        json.cfg = user_cfg;
>      } else {
>          json.cfg = luaL_checkserializer(l);
>      }
> -- 
> 2.20.1 (Apple Git-117)
>