From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id 7CBE86E233; Thu, 12 Nov 2026 02:40:09 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 7CBE86E233 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1794440409; bh=ez8+x24VJLoaKaHk3g4y/p+rpcNK4BQLubtJ0kbQfT0=; h=Date:To:References:In-Reply-To:Subject:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:Cc: From; b=p2lWdM0ObWnEB7T2A4ybVGAS5YkcA/tm9rvfORgPocXLRnST2FX0a/my5DFPYCQsv VpXmInS0SPehOFAQS6BCd1h0vqwZ3hH4HobdOLEurPIaNkO5MkQtu88hJI+HmWC3g7 3slVey4aENcWB3HJ9waY18gZF8FjHQH/1ZwBmdlI= Received: from send279.i.mail.ru (send279.i.mail.ru [95.163.59.118]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id AFFB06E233 for ; Thu, 12 Nov 2026 02:40:07 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org AFFB06E233 Received: by exim-smtp-canary-30-56f4b486d4-ljdx7 with esmtpa (envelope-from ) id 1xRHvC-000000004Aw-2O5G; Thu, 12 Nov 2026 02:40:07 +0300 Message-ID: <16fad0d6-b11c-49a9-8ca2-557b466f532d@tarantool.org> Date: Thu, 12 Nov 2026 02:40:06 +0300 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird To: Sergey Kaplun References: <20261111133805.1497870-1-skaplun@tarantool.org> Content-Language: en-US In-Reply-To: <20261111133805.1497870-1-skaplun@tarantool.org> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Mailru-Src: smtp X-4EC0790: 10 X-7564579A: 646B95376F6C166E X-77F55803: 4F1203BC0FB41BD911FEDD3DADD298F8D9016E3DF913DB54E7039521800A2FC7182A05F5380850404C228DA9ACA6FE2798867F13736046673DE06ABAFEAF67055FEB89CE67AD3C9DFEAB0FAE4178B24928006A18B89A766B X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE727FD6E7FC3A8F857EA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F7900637AC83A81C8FD4AD23D82A6BABE6F325AC2E85FA5F3EDFCBAA7353EFBB553375661F398E59D6539FAA3CA610AF48C751BF310048F9909CF7F66F6EBEBA6C13F921389733CBF5DBD5E9D5E8D9A59859A8B601F8F2FECC0250C8CC7F00164DA146DA6F5DAA56C3B73B237318B6A418E8EAB8090A508E0FED6299176DF2183F8FC7C08020A9F2AE89D33CCD04E86FAF290E2DB606B96278B59C421DD303D21008E29813377AFFFEAFD269A417C69337E82CC2E827F84554CEF50127C277FBC8AE2E8BA83251EDC214901ED5E8D9A59859A8B6BDB3AEF73D8456A4089D37D7C0E48F6C5571747095F342E88FB05168BE4CE3AF X-C1DE0DAB: 0D63561A33F958A5CD7B5DAB7E84EC235002B1117B3ED6962CA9EF4F979A03E0219207EC0A953D2C3610D81D389A125CDE35189EBF2DEA28FEA14CD2CD220BB99C5DF10A05D560A9880EC71AF561E0AAD9143641EC25BB39F2026F18F41B494C X-C8649E89: 1C3962B70DF3F0AD73CAD6646DEDE1918E10F71CB4DF9F96AB70F9BE574AE9C625B6776AC983F447FC0B9F89525902EE6F57B2FD27647F25E66C117BDB76D659B198CF2B1B3CF2790221EAF8675EB3821C04EC6CF4CEDF1458A96D2009A554DD91F7F2D48F468999B8341EE9D5BE9A0AB0F14EB4A0D11A2819842E9C36092E82E4C2BC9D7F547284C7CEAA0681F5848F4C41F94D744909CEEF9E35A692215F79327F81E6EEE0AEB67A0F9F91F029B6AF33F2C28C22F508233FCF178C6DD14203 X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu53w8ahmwBjZKM/YPHZyZHvz5uv+WouB9+ObcCpyrx6l7KImUglyhkEat/+ysWwi0gdhEs0JGjl6ggRWTy1haxBpVdbIX1nthFXOcIETfglQORZ0zpDET4Zrk3igikrdHlWJ74uTwV/fyXnNR0l9D9uPM= X-Mailru-Sender: 015BA6FC0EFA223A63A6570A1A031285C7BB73F453A5A17CB951B70A5BD4BD8E55C2462CDC55811EEAEC386BEEE43C4FE62B12C1FE0372A178274A4A9E9E44FD2A114EDA040D8818F01FF9DF31C397A372D6B4FCE48DF648AE208404248635DF X-Mras: Ok Subject: Re: [Tarantool-patches] [PATCH luajit] Clarify that lj_buf_shrink() does not keep any buffer data. X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Evgeniy Temirgaleev via Tarantool-patches Reply-To: Evgeniy Temirgaleev Cc: tarantool-patches@dev.tarantool.org Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" Hi, Sergey! Thanks for the patch! LGTM On 11/11/26 4:38 PM, Sergey Kaplun wrote: > From: Mike Pall > > https://www.freelists.org/post/luajit/lj-buf-shrink-may-truncate-the-data-and-sbw-point-over-the-end-of-the-buffer,1 > Thanks to Junlong li. > > (cherry picked from commit 444c8ff19a39248307a7037354d6d259cc0e5efc) > > When `lj_cf_string_format()` formats any object to the string via `%s` > it casts this object to a string implicitly on the first pass of parsing > the regexp. If the `__tostring` metamethod of the object invokes the > atomic step of the GC, GC shrinks the `tmpbuf` is used for string > formatting. In case when the result string occupies more than half of > the buffer, the writes in the second pass miss the buffer and may lead > to the heap-buffer-overflow, an invalid result string, or the core dump. > > This patch resets the current pointer position in the buffer in the > `lj_buf_shrink()` to avoid incorrect buffer writes. > > Sergey Kaplun: > * added the description and the test for the problem > > Resolves tarantool/tarantool#4171 > Part of tarantool/tarantool#13442 > --- > > Branch: https://github.com/tarantool/luajit/tree/skaplun/gh-4171-lj-cf-string-format-atomic > Related issues: > * https://github.com/tarantool/tarantool/issues/4171 > * https://github.com/tarantool/tarantool/issues/13442 > > src/lj_buf.c | 3 +- > ...h-4171-lj-cf-string-format-atomic.test.lua | 30 +++++++++++++++++++ > 2 files changed, 31 insertions(+), 2 deletions(-) > create mode 100644 test/tarantool-tests/gh-4171-lj-cf-string-format-atomic.test.lua > > diff --git a/src/lj_buf.c b/src/lj_buf.c > index 923f4276..bcfc4c93 100644 > --- a/src/lj_buf.c > +++ b/src/lj_buf.c > @@ -52,10 +52,9 @@ void LJ_FASTCALL lj_buf_shrink(lua_State *L, SBuf *sb) > char *b = sbufB(sb); > MSize osz = (MSize)(sbufE(sb) - b); > if (osz > 2*LJ_MIN_SBUF) { > - MSize n = (MSize)(sbufP(sb) - b); > b = lj_mem_realloc(L, b, osz, (osz >> 1)); > setmref(sb->b, b); > - setmref(sb->p, b + n); > + setmref(sb->p, b); /* Not supposed to keep data across shrinks. */ > setmref(sb->e, b + (osz >> 1)); > } > } > diff --git a/test/tarantool-tests/gh-4171-lj-cf-string-format-atomic.test.lua b/test/tarantool-tests/gh-4171-lj-cf-string-format-atomic.test.lua > new file mode 100644 > index 00000000..c601ce08 > --- /dev/null > +++ b/test/tarantool-tests/gh-4171-lj-cf-string-format-atomic.test.lua > @@ -0,0 +1,30 @@ > +local tap = require('tap') > + > +-- The test file demonstrates `string.format()` > +-- heap-buffer-overflow under ASAN if the atomic phase of the GC > +-- is entered during the first pass of formatting with implicit > +-- conversion of the argument to a string via %s. > +-- See also: https://github.com/tarantool/tarantool/issues/4171. > +local test = tap.test('gh-4171-lj-cf-string-format-atomic') > + > +test:plan(1) > + > +local obj = setmetatable({}, { > + __tostring = function() > + -- Shrinks `tmpbuf`: 256 -> 128 (but length of string is 200). > + collectgarbage() > + return 'x' > + end > +}) > + > +local prefix = string.rep('a', 200) > + > +-- %s triggers a full GC cycle, including `tmpbuf` shrinking in > +-- the atomic phase. '_suffix' was written outside the buffer > +-- before the patch. > +local res = string.format(prefix .. '%s_suffix', obj) > + > +-- Under ASAN this leads to heap-buffer-overflow. > +test:is(res, prefix .. 'x_suffix', 'correct string format result') > + > +test:done(true) -- -- Best regards, Evgeniy Temirgaleev