Tarantool development patches archive
 help / color / mirror / Atom feed
From: Alexander Turenko <alexander.turenko@tarantool.org>
To: Vladislav Shpilevoy <v.shpilevoy@tarantool.org>
Cc: tarantool-patches@freelists.org,
	AKhatskevich <avkhatskevich@tarantool.org>
Subject: [tarantool-patches] Re: [PATCH v2 1/3] lua-yaml: verify arguments count
Date: Tue, 5 Feb 2019 06:29:30 +0300	[thread overview]
Message-ID: <20190205032929.gbcapbbgbnpfolnl@tkn_work_nb> (raw)
In-Reply-To: <04a54285-aa7c-2726-0077-64c14a40dde6@tarantool.org>

Hi!

See answers below.

I'll send the updated patchset as v3 soon.

WBR, Alexander Turenko.

On Fri, Jan 25, 2019 at 12:26:53AM +0300, Vladislav Shpilevoy wrote:
> Thanks for the patch!
> 
> On 22/01/2019 05:12, Alexander Turenko wrote:
> > From: AKhatskevich <avkhatskevich@tarantool.org>
> > 
> > Added arguments count check for yaml.encode() and decode.decode()
> 
> Typo: 'decode.decode' -> 'yaml.decode'.

Thx. Fixed.

> 
> > functions.
> > 
> > Without these checks the functions could read garbage outside of a Lua
> > stack when called w/o arguments.
> 
> Honestly, I do not understand how is it possible. Please,
> provide a test for both functions. See my 3 doubts below.

lua_isstring(L, 1) checks a garbage w/o preliminary lua_gettop() check.
yaml.encode() gives me "unsupported Lua type 'thread'" on the current
tarantool 2.1.

Anyway, added bad API usage test cases. Also I changed this:

diff --git a/third_party/lua-yaml/lyaml.cc b/third_party/lua-yaml/lyaml.cc
index 3a427263e..46374970f 100644
--- a/third_party/lua-yaml/lyaml.cc
+++ b/third_party/lua-yaml/lyaml.cc
@@ -453,7 +453,7 @@ usage_error:
       return luaL_error(L, OOM_ERRMSG);
    yaml_parser_set_input_string(&loader.parser, (yaml_char_t *) document, len);
    bool tag_only;
-   if (lua_gettop(L) == 2) {
+   if (lua_gettop(L) == 2 && ! lua_isnil(L, 2)) {
       if (! lua_istable(L, 2))
          goto usage_error;
       lua_getfield(L, 2, "tag_only");

We should not raise an usage error for yaml.decode(object, nil).

> 
> > ---
> >   third_party/lua-yaml/lyaml.cc | 7 ++++---
> >   1 file changed, 4 insertions(+), 3 deletions(-)
> > 
> > diff --git a/third_party/lua-yaml/lyaml.cc b/third_party/lua-yaml/lyaml.cc
> > index c6d118a79..9b07992d8 100644
> > --- a/third_party/lua-yaml/lyaml.cc
> > +++ b/third_party/lua-yaml/lyaml.cc
> > @@ -400,7 +400,8 @@ static void load(struct lua_yaml_loader *loader) {
> >    */
> >   static int l_load(lua_State *L) {
> >      struct lua_yaml_loader loader;
> > -   if (! lua_isstring(L, 1)) {
> > +   int top = lua_gettop(L);
> > +   if (!(top == 1 || top == 2) || !lua_isstring(L, 1)) {
> 
> 1. How could the old code lead to a bug, if there was a
> check if the first argument is a string? The second argument

It does not check a stack top (arguments count).

> is not used until the next hunk, about which see my next
> comment

As I see it is usual way to write such functions: check whether count of
arguments and types of mandatory arguments are valid at start of the
function.

> 
> >   usage_error:
> >         return luaL_error(L, "Usage: yaml.decode(document, "\
> >                           "[{tag_only = boolean}])");
> > @@ -416,7 +417,7 @@ usage_error:
> >         return luaL_error(L, OOM_ERRMSG);
> >      yaml_parser_set_input_string(&loader.parser, (yaml_char_t *) document, len);
> >      bool tag_only;
> > -   if (lua_gettop(L) > 1) {
> > +   if (lua_gettop(L) == 2) {
> 
> 2. This function never touches anything beyond second value on
> the stack, so here lua_gettop(L) > 1 means the same as
> lua_gettop(L) == 2 - the second argument exist. Third and next
> values do not matter.

I read this as 'those are equivalent' (correct me if I'm wrong). Ok. I'd
prefer to leave it with ==. Also note the fix I pasted above.

> 
> >         if (! lua_istable(L, 2))
> >            goto usage_error;
> >         lua_getfield(L, 2, "tag_only");
> > @@ -794,7 +795,7 @@ error:
> >   static int l_dump(lua_State *L) {
> >      struct luaL_serializer *serializer = luaL_checkserializer(L);
> >      int top = lua_gettop(L);
> > -   if (top > 2) {
> > +   if (!(top == 1 || top == 2)) {
> 
> 3. Here my reasoning is the same - the previous checking works
> as well.

It will not give an error in case of yaml.encode() and yaml.encode({},
{}, {}).

> 
> >   usage_error:
> >         return luaL_error(L, "Usage: encode(object, {tag_prefix = <string>, "\
> >                           "tag_handle = <string>})");
> > 

  reply	other threads:[~2019-02-05  3:29 UTC|newest]

Thread overview: 23+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-01-22  2:12 [tarantool-patches] [PATCH v2 0/3] lua-yaml null/boolean fixes Alexander Turenko
2019-01-22  2:12 ` [tarantool-patches] [PATCH v2 1/3] lua-yaml: verify arguments count Alexander Turenko
2019-01-24 21:26   ` [tarantool-patches] " Vladislav Shpilevoy
2019-02-05  3:29     ` Alexander Turenko [this message]
2019-02-05 19:36       ` Vladislav Shpilevoy
2019-02-11 13:32         ` Alexander Turenko
2019-02-15 21:28           ` Vladislav Shpilevoy
2019-01-22  2:12 ` [tarantool-patches] [PATCH v2 2/3] lua-yaml: fix boolean/null representation in yaml Alexander Turenko
2019-01-24 21:26   ` [tarantool-patches] " Vladislav Shpilevoy
2019-01-24 21:32     ` Vladislav Shpilevoy
2019-02-05  3:29     ` Alexander Turenko
2019-02-05 19:36       ` Vladislav Shpilevoy
2019-02-15 21:06         ` Vladislav Shpilevoy
2019-02-15 21:23           ` Alexander Turenko
2019-02-18 18:55         ` Alexander Turenko
2019-02-22 15:14           ` Vladislav Shpilevoy
2019-01-22  2:12 ` [tarantool-patches] [PATCH v2 3/3] lua-yaml: treat an empty document/value as null Alexander Turenko
2019-01-24 21:26   ` [tarantool-patches] " Vladislav Shpilevoy
2019-02-05  3:30     ` Alexander Turenko
2019-01-24 21:26 ` [tarantool-patches] Re: [PATCH v2 0/3] lua-yaml null/boolean fixes Vladislav Shpilevoy
2019-02-25 11:27 ` Kirill Yukhin
2019-03-05 16:40   ` Alexander Turenko
2019-03-06  7:21     ` Kirill Yukhin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190205032929.gbcapbbgbnpfolnl@tkn_work_nb \
    --to=alexander.turenko@tarantool.org \
    --cc=avkhatskevich@tarantool.org \
    --cc=tarantool-patches@freelists.org \
    --cc=v.shpilevoy@tarantool.org \
    --subject='[tarantool-patches] Re: [PATCH v2 1/3] lua-yaml: verify arguments count' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox