From: Alexander Turenko <alexander.turenko@tarantool.org> To: Vladislav Shpilevoy <v.shpilevoy@tarantool.org> Cc: tarantool-patches@freelists.org, AKhatskevich <avkhatskevich@tarantool.org> Subject: [tarantool-patches] Re: [PATCH v2 1/3] lua-yaml: verify arguments count Date: Tue, 5 Feb 2019 06:29:30 +0300 [thread overview] Message-ID: <20190205032929.gbcapbbgbnpfolnl@tkn_work_nb> (raw) In-Reply-To: <04a54285-aa7c-2726-0077-64c14a40dde6@tarantool.org> Hi! See answers below. I'll send the updated patchset as v3 soon. WBR, Alexander Turenko. On Fri, Jan 25, 2019 at 12:26:53AM +0300, Vladislav Shpilevoy wrote: > Thanks for the patch! > > On 22/01/2019 05:12, Alexander Turenko wrote: > > From: AKhatskevich <avkhatskevich@tarantool.org> > > > > Added arguments count check for yaml.encode() and decode.decode() > > Typo: 'decode.decode' -> 'yaml.decode'. Thx. Fixed. > > > functions. > > > > Without these checks the functions could read garbage outside of a Lua > > stack when called w/o arguments. > > Honestly, I do not understand how is it possible. Please, > provide a test for both functions. See my 3 doubts below. lua_isstring(L, 1) checks a garbage w/o preliminary lua_gettop() check. yaml.encode() gives me "unsupported Lua type 'thread'" on the current tarantool 2.1. Anyway, added bad API usage test cases. Also I changed this: diff --git a/third_party/lua-yaml/lyaml.cc b/third_party/lua-yaml/lyaml.cc index 3a427263e..46374970f 100644 --- a/third_party/lua-yaml/lyaml.cc +++ b/third_party/lua-yaml/lyaml.cc @@ -453,7 +453,7 @@ usage_error: return luaL_error(L, OOM_ERRMSG); yaml_parser_set_input_string(&loader.parser, (yaml_char_t *) document, len); bool tag_only; - if (lua_gettop(L) == 2) { + if (lua_gettop(L) == 2 && ! lua_isnil(L, 2)) { if (! lua_istable(L, 2)) goto usage_error; lua_getfield(L, 2, "tag_only"); We should not raise an usage error for yaml.decode(object, nil). > > > --- > > third_party/lua-yaml/lyaml.cc | 7 ++++--- > > 1 file changed, 4 insertions(+), 3 deletions(-) > > > > diff --git a/third_party/lua-yaml/lyaml.cc b/third_party/lua-yaml/lyaml.cc > > index c6d118a79..9b07992d8 100644 > > --- a/third_party/lua-yaml/lyaml.cc > > +++ b/third_party/lua-yaml/lyaml.cc > > @@ -400,7 +400,8 @@ static void load(struct lua_yaml_loader *loader) { > > */ > > static int l_load(lua_State *L) { > > struct lua_yaml_loader loader; > > - if (! lua_isstring(L, 1)) { > > + int top = lua_gettop(L); > > + if (!(top == 1 || top == 2) || !lua_isstring(L, 1)) { > > 1. How could the old code lead to a bug, if there was a > check if the first argument is a string? The second argument It does not check a stack top (arguments count). > is not used until the next hunk, about which see my next > comment As I see it is usual way to write such functions: check whether count of arguments and types of mandatory arguments are valid at start of the function. > > > usage_error: > > return luaL_error(L, "Usage: yaml.decode(document, "\ > > "[{tag_only = boolean}])"); > > @@ -416,7 +417,7 @@ usage_error: > > return luaL_error(L, OOM_ERRMSG); > > yaml_parser_set_input_string(&loader.parser, (yaml_char_t *) document, len); > > bool tag_only; > > - if (lua_gettop(L) > 1) { > > + if (lua_gettop(L) == 2) { > > 2. This function never touches anything beyond second value on > the stack, so here lua_gettop(L) > 1 means the same as > lua_gettop(L) == 2 - the second argument exist. Third and next > values do not matter. I read this as 'those are equivalent' (correct me if I'm wrong). Ok. I'd prefer to leave it with ==. Also note the fix I pasted above. > > > if (! lua_istable(L, 2)) > > goto usage_error; > > lua_getfield(L, 2, "tag_only"); > > @@ -794,7 +795,7 @@ error: > > static int l_dump(lua_State *L) { > > struct luaL_serializer *serializer = luaL_checkserializer(L); > > int top = lua_gettop(L); > > - if (top > 2) { > > + if (!(top == 1 || top == 2)) { > > 3. Here my reasoning is the same - the previous checking works > as well. It will not give an error in case of yaml.encode() and yaml.encode({}, {}, {}). > > > usage_error: > > return luaL_error(L, "Usage: encode(object, {tag_prefix = <string>, "\ > > "tag_handle = <string>})"); > >
next prev parent reply other threads:[~2019-02-05 3:29 UTC|newest] Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-01-22 2:12 [tarantool-patches] [PATCH v2 0/3] lua-yaml null/boolean fixes Alexander Turenko 2019-01-22 2:12 ` [tarantool-patches] [PATCH v2 1/3] lua-yaml: verify arguments count Alexander Turenko 2019-01-24 21:26 ` [tarantool-patches] " Vladislav Shpilevoy 2019-02-05 3:29 ` Alexander Turenko [this message] 2019-02-05 19:36 ` Vladislav Shpilevoy 2019-02-11 13:32 ` Alexander Turenko 2019-02-15 21:28 ` Vladislav Shpilevoy 2019-01-22 2:12 ` [tarantool-patches] [PATCH v2 2/3] lua-yaml: fix boolean/null representation in yaml Alexander Turenko 2019-01-24 21:26 ` [tarantool-patches] " Vladislav Shpilevoy 2019-01-24 21:32 ` Vladislav Shpilevoy 2019-02-05 3:29 ` Alexander Turenko 2019-02-05 19:36 ` Vladislav Shpilevoy 2019-02-15 21:06 ` Vladislav Shpilevoy 2019-02-15 21:23 ` Alexander Turenko 2019-02-18 18:55 ` Alexander Turenko 2019-02-22 15:14 ` Vladislav Shpilevoy 2019-01-22 2:12 ` [tarantool-patches] [PATCH v2 3/3] lua-yaml: treat an empty document/value as null Alexander Turenko 2019-01-24 21:26 ` [tarantool-patches] " Vladislav Shpilevoy 2019-02-05 3:30 ` Alexander Turenko 2019-01-24 21:26 ` [tarantool-patches] Re: [PATCH v2 0/3] lua-yaml null/boolean fixes Vladislav Shpilevoy 2019-02-25 11:27 ` Kirill Yukhin 2019-03-05 16:40 ` Alexander Turenko 2019-03-06 7:21 ` Kirill Yukhin
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20190205032929.gbcapbbgbnpfolnl@tkn_work_nb \ --to=alexander.turenko@tarantool.org \ --cc=avkhatskevich@tarantool.org \ --cc=tarantool-patches@freelists.org \ --cc=v.shpilevoy@tarantool.org \ --subject='[tarantool-patches] Re: [PATCH v2 1/3] lua-yaml: verify arguments count' \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox