From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id 977906F15B; Tue, 23 Aug 2022 11:09:37 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 977906F15B DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1661242177; bh=bzQGEl6Dc5djs6TXyAFyn/edg9UODBy5vldHojCHYBI=; h=To:Date:Subject:List-Id:List-Unsubscribe:List-Archive:List-Post: List-Help:List-Subscribe:From:Reply-To:Cc:From; b=u31bnHnPKgdeX9wnS9cVfM4ZyNKp6psAFgxlPnYZ04ZznzL12rwoJVhqe+b3nJ3r0 N2P+j/YxoNJ5nmfSqnKVnYMSlz6IPh51aKNC2wtLRI+0wWAgaKDrsxjJyI5gw1PY9F jA9THsYc46TQOeqJRk45U97obgdunrkHa5HKwUjs= Received: from smtpng3.i.mail.ru (smtpng3.i.mail.ru [94.100.177.149]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id A304D6F15B for ; Tue, 23 Aug 2022 11:09:35 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org A304D6F15B Received: by smtpng3.m.smailru.net with esmtpa (envelope-from ) id 1oQOyc-0006pH-SH; Tue, 23 Aug 2022 11:09:35 +0300 To: Sergey Ostanevich , Maxim Kokryashkin Date: Tue, 23 Aug 2022 11:06:59 +0300 Message-Id: <20220823080659.16880-1-skaplun@tarantool.org> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Mailru-Src: smtp X-7564579A: B8F34718100C35BD X-77F55803: 4F1203BC0FB41BD999D8F08CF16C6CA7380E6FC44ABC918E172B7849A70FF54100894C459B0CD1B943486B6A0995DB0660455E247D495906A55A77B72ED6E967485234136DCFB6CD X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE705B093C0FC4B30B9EA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F7900637328FC23D015AFE6E8638F802B75D45FF36EB9D2243A4F8B5A6FCA7DBDB1FC311F39EFFDF887939037866D6147AF826D81D2B27FB05BC04618BA8B54882B9783B117882F4460429724CE54428C33FAD305F5C1EE8F4F765FC55B19328CBC4F849A471835C12D1D9774AD6D5ED66289B52BA9C0B312567BB23117882F44604297287769387670735201E561CDFBCA1751FF6B57BC7E6449061A352F6E88A58FB86F5D81C698A659EA7E827F84554CEF5019E625A9149C048EE9ECD01F8117BC8BEE2021AF6380DFAD18AA50765F790063735872C767BF85DA227C277FBC8AE2E8BB9CEE4F2B4A90F8475ECD9A6C639B01B4E70A05D1297E1BBCB5012B2E24CD356 X-C1DE0DAB: C20DE7B7AB408E4181F030C43753B8186998911F362727C41E93BD56E7067354307CAA32FF218580205367B2BCC23E5B723506D9B6F3A961E7E65F06B2D3BF1CAD91A466A1DEF99B6ED91DBE5ABE359A3485EE9140A7D39D4E9387F6EE012401E4CE366BA8449426C33C4008E80C9228BB1D685B84016B67B1881A6453793CE9C32612AADDFBE061E7CF831D07CEC04EA71A35648BE338CE9510FB958DCE06DB58C12E6D310A6D5333F7A9E5587C79A693EDB24507CE13387DFF0A840B692CF8 X-C8649E89: 4E36BF7865823D7055A7F0CF078B5EC49A30900B95165D345C064E16D8ABF335A04400441C10AADFBF3B35ADF6F3231D33181C3E13C97128CAD876DC093A83AB1D7E09C32AA3244C91BDD161DB40610B14F263B0A10266B33A92A9747B6CC886927AC6DF5659F194 X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu530nj6fImhcD4MUrOEAnl0W826KZ9Q+tr5ycPtXkTV4k65bRjmOUUP8cvGozZ33TWg5HZplvhhXbhDGzqmQDTd6OAevLeAnq3Ra9uf7zvY2zzsIhlcp/Y7m53TZgf2aB4JOg4gkr2biojzEOgLjt8B1qD4Grym2N8ow== X-DA7885C5: F6C71B927DB11D6E67ABCBAFE8FB948C482F0ACE950A128392D7B96D23342F88262E2D401490A4A0DB037EFA58388B346E8BC1A9835FDE71 X-Mailru-Sender: 689FA8AB762F7393CC2E0F076E87284E47787ECCE19DEA9326265B5A927FBD4C0FBE9A32752B8C9C2AA642CC12EC09F1FB559BB5D741EB962F61BD320559CF1EFD657A8799238ED55FEEDEB644C299C0ED14614B50AE0675 X-Mras: Ok Subject: [Tarantool-patches] [PATCH luajit] Fix overflow check in unpack(). X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Sergey Kaplun via Tarantool-patches Reply-To: Sergey Kaplun Cc: tarantool-patches@dev.tarantool.org Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" From: Mike Pall Thanks to HybridDog. When build with optimization compiler may throw away overflow check in `unpack()` base library function. This patch prevents aforementioned error by comparing the unsigned amount of values to unpack with `LUAI_MAXCSTACK` instead of 0. Sergey Kaplun: * added the description and the test for the problem Part of tarantool/tarantool#7230 --- Issue/PR: * https://github.com/LuaJIT/LuaJIT/pull/574 * https://github.com/tarantool/tarantool/issues/7230 Branch: https://github.com/tarantool/luajit/tree/skaplun/lj-574-overflow-unpack-full-ci PR: https://github.com/tarantool/tarantool/pull/7596 src/lib_base.c | 6 ++++-- test/tarantool-tests/lj-574-overflow-unpack.test.lua | 12 ++++++++++++ 2 files changed, 16 insertions(+), 2 deletions(-) create mode 100644 test/tarantool-tests/lj-574-overflow-unpack.test.lua diff --git a/src/lib_base.c b/src/lib_base.c index 613a1859..cf57b4f2 100644 --- a/src/lib_base.c +++ b/src/lib_base.c @@ -224,9 +224,11 @@ LJLIB_CF(unpack) int32_t n, i = lj_lib_optint(L, 2, 1); int32_t e = (L->base+3-1 < L->top && !tvisnil(L->base+3-1)) ? lj_lib_checkint(L, 3) : (int32_t)lj_tab_len(t); + uint32_t nu; if (i > e) return 0; - n = e - i + 1; - if (n <= 0 || !lua_checkstack(L, n)) + nu = (uint32_t)e - (uint32_t)i; + n = (int32_t)(nu+1); + if (nu >= LUAI_MAXCSTACK || !lua_checkstack(L, n)) lj_err_caller(L, LJ_ERR_UNPACK); do { cTValue *tv = lj_tab_getint(t, i); diff --git a/test/tarantool-tests/lj-574-overflow-unpack.test.lua b/test/tarantool-tests/lj-574-overflow-unpack.test.lua new file mode 100644 index 00000000..6715d947 --- /dev/null +++ b/test/tarantool-tests/lj-574-overflow-unpack.test.lua @@ -0,0 +1,12 @@ +local tap = require('tap') + +-- Test file to demonstrate integer overflow in the `unpack()` +-- function due to compiler optimization. +-- See also https://github.com/LuaJIT/LuaJIT/pull/574. +local test = tap.test('lj-574-overflow-unpack') +test:plan(1) + +local r, e = pcall(unpack, {}, 0, 2^31 - 1) +test:ok(not r and e == 'too many results to unpack', 'overflow check in unpack') + +os.exit(test:check() and 0 or 1) -- 2.34.1