From: Sergey Kaplun via Tarantool-patches <tarantool-patches@dev.tarantool.org> To: Maxim Kokryashkin <m.kokryashkin@tarantool.org>, Sergey Bronnikov <sergeyb@tarantool.org> Cc: tarantool-patches@dev.tarantool.org Subject: [Tarantool-patches] [PATCH luajit] FFI: Fix __tostring metamethod access to enum cdata value. Date: Mon, 19 Aug 2024 14:41:33 +0300 [thread overview] Message-ID: <20240819114133.2083-1-skaplun@tarantool.org> (raw) From: Mike Pall <mike> Thanks to Sergey Kaplun. (cherry picked from commit f2a1cd43281361035149b6eedbd267b5e71d64d0) On a 64-bit host, `*(uint32_t **)p` (in the `lj_cf_ffi_meta___tostring()`) is the read of 8 bytes, while the size of the cdata tail for the enum is only 4. This leads to heap-buffer-overflow during the call of `tostring()` on the corresponding cdata. This patch fixes the pointer cast to `(uint32_t *)p`, which is correct. Sergey Kaplun: * added the description and the test for the problem Part of tarantool/tarantool#10199 --- Branch: https://github.com/tarantool/luajit/tree/skaplun/lj-1232-fix-enum-tostring Related issues: * https://github.com/LuaJIT/LuaJIT/issues/1232 * https://github.com/tarantool/tarantool/issues/10199 src/lib_ffi.c | 2 +- .../lj-1232-fix-enum-tostring.test.lua | 21 +++++++++++++++++++ 2 files changed, 22 insertions(+), 1 deletion(-) create mode 100644 test/tarantool-tests/lj-1232-fix-enum-tostring.test.lua diff --git a/src/lib_ffi.c b/src/lib_ffi.c index 3c8dd77f..7988dab8 100644 --- a/src/lib_ffi.c +++ b/src/lib_ffi.c @@ -305,7 +305,7 @@ LJLIB_CF(ffi_meta___tostring) p = *(void **)p; } else if (ctype_isenum(ct->info)) { msg = "cdata<%s>: %d"; - p = (void *)(uintptr_t)*(uint32_t **)p; + p = (void *)(uintptr_t)*(uint32_t *)p; } else { if (ctype_isptr(ct->info)) { p = cdata_getptr(p, ct->size); diff --git a/test/tarantool-tests/lj-1232-fix-enum-tostring.test.lua b/test/tarantool-tests/lj-1232-fix-enum-tostring.test.lua new file mode 100644 index 00000000..073bfcb6 --- /dev/null +++ b/test/tarantool-tests/lj-1232-fix-enum-tostring.test.lua @@ -0,0 +1,21 @@ +local tap = require('tap') + +-- Test file to demonstrate heap-buffer-overflow in the +-- `tostring()` call for the enum cdata. +-- See also: https://github.com/LuaJIT/LuaJIT/issues/1232. + +local test = tap.test('lj-1232-fix-enum-tostring') + +local ffi = require('ffi') +local ENUM_VAL = 1 +local EXPECTED = 'cdata<enum %d+>: ' .. ENUM_VAL + +test:plan(1) + +local cdata_enum = ffi.new(('enum {foo = %d}'):format(ENUM_VAL), ENUM_VAL) + +-- XXX: The test shows heap-buffer-overflow only under ASAN. + +test:like(tostring(cdata_enum), EXPECTED, 'correct tostring result') + +test:done(true) -- 2.45.2
next reply other threads:[~2024-08-19 11:41 UTC|newest] Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top 2024-08-19 11:41 Sergey Kaplun via Tarantool-patches [this message] 2024-09-03 14:36 ` Sergey Bronnikov via Tarantool-patches
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20240819114133.2083-1-skaplun@tarantool.org \ --to=tarantool-patches@dev.tarantool.org \ --cc=m.kokryashkin@tarantool.org \ --cc=sergeyb@tarantool.org \ --cc=skaplun@tarantool.org \ --subject='Re: [Tarantool-patches] [PATCH luajit] FFI: Fix __tostring metamethod access to enum cdata value.' \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox