[PATCH 1/1] msgpack: validate msgpack.decode() cdata size argument

[PATCH 1/1] msgpack: validate msgpack.decode() cdata size argument

[Vladislav Shpilevoy]

Negative size led to an assertion. The commit adds a check if
size is negative.

Closes #4224
---
Branch: https://github.com/tarantool/tarantool/tree/gerold103/gh-4224-msgpack-decode-assertion

The commit should be cherry-picked to 2.1 and 1.10.

 src/lua/msgpack.c         | 6 +++++-
 test/app/msgpack.result   | 8 ++++++++
 test/app/msgpack.test.lua | 6 ++++++
 3 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/src/lua/msgpack.c b/src/lua/msgpack.c
index 66b83b894..2126988eb 100644
--- a/src/lua/msgpack.c
+++ b/src/lua/msgpack.c
@@ -336,7 +336,11 @@ lua_msgpack_decode_cdata(lua_State *L, bool check)
 				  "a Lua string or 'char *' expected");
 	}
 	if (check) {
-		size_t data_len = luaL_checkinteger(L, 2);
+		ptrdiff_t data_len = luaL_checkinteger(L, 2);
+		if (data_len < 0) {
+			return luaL_error(L, "msgpack.decode: size can't be "\
+					  "negative");
+		}
 		const char *p = data;
 		if (mp_check(&p, data + data_len) != 0)
 			return luaL_error(L, "msgpack.decode: invalid MsgPack");
diff --git a/test/app/msgpack.result b/test/app/msgpack.result
index 105f503da..a67c05d38 100644
--- a/test/app/msgpack.result
+++ b/test/app/msgpack.result
@@ -244,3 +244,11 @@ size = msgpack.encode(100, buf)
 ---
 - 100
 ...
+--
+-- gh-4224: msgpack.decode(cdata, size) should check, that size
+-- is not negative.
+--
+msgpack.decode(ffi.cast('char *', '\x04\x05\x06'), -1)
+---
+- error: 'msgpack.decode: size can''t be negative'
+...
diff --git a/test/app/msgpack.test.lua b/test/app/msgpack.test.lua
index de8fd4e37..e0880ac22 100644
--- a/test/app/msgpack.test.lua
+++ b/test/app/msgpack.test.lua
@@ -78,3 +78,9 @@ buf:reset()
 size = msgpack.encode(100, buf)
 (msgpack.decode(ffi.cast('char *', buf.rpos), size))
 (msgpack.decode(ffi.cast('const char *', buf.rpos), size))
+
+--
+-- gh-4224: msgpack.decode(cdata, size) should check, that size
+-- is not negative.
+--
+msgpack.decode(ffi.cast('char *', '\x04\x05\x06'), -1)
-- 
2.20.1 (Apple Git-117)

Re: [PATCH 1/1] msgpack: validate msgpack.decode() cdata size argument

[Vladimir Davydov]

On Fri, May 17, 2019 at 02:44:25PM +0300, Vladislav Shpilevoy wrote:
> Negative size led to an assertion. The commit adds a check if
> size is negative.
> 
> Closes #4224

Pushed to master, 2.1, and 1.10.