From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id AA522C3FEE1; Mon, 19 Aug 2024 14:41:42 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org AA522C3FEE1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1724067702; bh=V1GqrdZpnSOgKMtWRJuUMdZU5x/OXvHDImZ5HuvBrBE=; h=To:Date:Subject:List-Id:List-Unsubscribe:List-Archive:List-Post: List-Help:List-Subscribe:From:Reply-To:Cc:From; b=c1OPdvvKDXG+0ObwJ3Xh9L9gPhzkNBc85VjFPBvscpd4MfQHLrqQXhgaeC0P2fVj4 BKApXRnBe15+cX6lUbpZ6RdKI6IRTZwnb4Dvpvb+ahyA/jaWa/Z7YUieIvZX4zLUJn c6ozzWlbA0pVwcgfTdZdwQ77SDgae6NVNl7VCgYs= Received: from smtp44.i.mail.ru (smtp44.i.mail.ru [95.163.41.82]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id 1A5D4C3FEC1 for ; Mon, 19 Aug 2024 14:41:41 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 1A5D4C3FEC1 Received: by smtp44.i.mail.ru with esmtpa (envelope-from ) id 1sg0lX-0000000DlT5-2yxF; Mon, 19 Aug 2024 14:41:40 +0300 To: Maxim Kokryashkin , Sergey Bronnikov Date: Mon, 19 Aug 2024 14:41:33 +0300 Message-ID: <20240819114133.2083-1-skaplun@tarantool.org> X-Mailer: git-send-email 2.45.2 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Mailru-Src: smtp X-7564579A: 78E4E2B564C1792B X-77F55803: 4F1203BC0FB41BD9F97E3C14763C38E2F8667C40DD8CE92DDCF89D65A2CC9925182A05F5380850405DF4C28BDFC68BFBAC8EDD30083ED68EF16CF8F950FCE67064235D8C8CFFAD0DBA9B74B89E600C9A X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE76D4A2B7BAC4DEDB8EA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F7900637A8691684BB8CCFB18638F802B75D45FF36EB9D2243A4F8B5A6FCA7DBDB1FC311F39EFFDF887939037866D6147AF826D8629C1C42457D85724592614CCD6F668AFCD4B3B112F34699CC7F00164DA146DAFE8445B8C89999728AA50765F79006372A3B24BF85B2E607389733CBF5DBD5E9C8A9BA7A39EFB766F5D81C698A659EA7CC7F00164DA146DA9985D098DBDEAEC8BC0ADEB1C81BB362F6B57BC7E6449061A352F6E88A58FB86F5D81C698A659EA7E827F84554CEF5019E625A9149C048EE33AC447995A7AD182BEBFE083D3B9BA73A03B725D353964B2FFDA4F57982C5F435872C767BF85DA227C277FBC8AE2E8B779389CF6F126FEC75ECD9A6C639B01B4E70A05D1297E1BBCB5012B2E24CD356 X-C1DE0DAB: 0D63561A33F958A5E4E3A9E3FE37CF545002B1117B3ED696767255F48D4BACABED71F038FC046993823CB91A9FED034534781492E4B8EEAD9F68E8F4EDE74A9DC79554A2A72441328621D336A7BC284946AD531847A6065A535571D14F44ED41 X-C8649E89: 1C3962B70DF3F0ADE00A9FD3E00BEEDF77DD89D51EBB7742D3581295AF09D3DF87807E0823442EA2ED31085941D9CD0AF7F820E7B07EA4CF9F3C2C69CE65CD8841CCD0955C7067B446F69A91F55A470CBF710BF4F980F6CF384CCA0DA9D2472CD14E51FF79EEE603BDFC3374F48900E30B6796BDEB665C195692A66B4C4972DEC226CC413062362A913E6812662D5F2A5EAB5682573093F7837F15F2B5E4A70B33F2C28C22F508233FCF178C6DD14203 X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu530nj6fImhcD4MUrOEAnl0W826KZ9Q+tr5ycPtXkTV4k65bRjmOUUP8cvGozZ33TWg5HZplvhhXbhDGzqmQDTd6OAevLeAnq3Ra9uf7zvY2zzsIhlcp/Y7m53TZgf2aB4JOg4gkr2biojxd0rRjfnTmZbohbwBZtOMQ== X-DA7885C5: FD8E183FF2B9812DF255D290C0D534F9FD644B571E9FEC6F980E8C73663A267D4A1EA99AD8C75CD15B1A4C17EAA7BC4BEF2421ABFA55128DAF83EF9164C44C7E X-Mailru-Sender: 689FA8AB762F7393C6D0B12EA33CAA9B2084031CF6446A4889A0824CFA38E3F481329D2B6AB3C25FE49D44BB4BD9522A059A1ED8796F048DB274557F927329BE89D5A3BC2B10C37545BD1C3CC395C826B4A721A3011E896F X-Mras: Ok Subject: [Tarantool-patches] [PATCH luajit] FFI: Fix __tostring metamethod access to enum cdata value. X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Sergey Kaplun via Tarantool-patches Reply-To: Sergey Kaplun Cc: tarantool-patches@dev.tarantool.org Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" From: Mike Pall Thanks to Sergey Kaplun. (cherry picked from commit f2a1cd43281361035149b6eedbd267b5e71d64d0) On a 64-bit host, `*(uint32_t **)p` (in the `lj_cf_ffi_meta___tostring()`) is the read of 8 bytes, while the size of the cdata tail for the enum is only 4. This leads to heap-buffer-overflow during the call of `tostring()` on the corresponding cdata. This patch fixes the pointer cast to `(uint32_t *)p`, which is correct. Sergey Kaplun: * added the description and the test for the problem Part of tarantool/tarantool#10199 --- Branch: https://github.com/tarantool/luajit/tree/skaplun/lj-1232-fix-enum-tostring Related issues: * https://github.com/LuaJIT/LuaJIT/issues/1232 * https://github.com/tarantool/tarantool/issues/10199 src/lib_ffi.c | 2 +- .../lj-1232-fix-enum-tostring.test.lua | 21 +++++++++++++++++++ 2 files changed, 22 insertions(+), 1 deletion(-) create mode 100644 test/tarantool-tests/lj-1232-fix-enum-tostring.test.lua diff --git a/src/lib_ffi.c b/src/lib_ffi.c index 3c8dd77f..7988dab8 100644 --- a/src/lib_ffi.c +++ b/src/lib_ffi.c @@ -305,7 +305,7 @@ LJLIB_CF(ffi_meta___tostring) p = *(void **)p; } else if (ctype_isenum(ct->info)) { msg = "cdata<%s>: %d"; - p = (void *)(uintptr_t)*(uint32_t **)p; + p = (void *)(uintptr_t)*(uint32_t *)p; } else { if (ctype_isptr(ct->info)) { p = cdata_getptr(p, ct->size); diff --git a/test/tarantool-tests/lj-1232-fix-enum-tostring.test.lua b/test/tarantool-tests/lj-1232-fix-enum-tostring.test.lua new file mode 100644 index 00000000..073bfcb6 --- /dev/null +++ b/test/tarantool-tests/lj-1232-fix-enum-tostring.test.lua @@ -0,0 +1,21 @@ +local tap = require('tap') + +-- Test file to demonstrate heap-buffer-overflow in the +-- `tostring()` call for the enum cdata. +-- See also: https://github.com/LuaJIT/LuaJIT/issues/1232. + +local test = tap.test('lj-1232-fix-enum-tostring') + +local ffi = require('ffi') +local ENUM_VAL = 1 +local EXPECTED = 'cdata: ' .. ENUM_VAL + +test:plan(1) + +local cdata_enum = ffi.new(('enum {foo = %d}'):format(ENUM_VAL), ENUM_VAL) + +-- XXX: The test shows heap-buffer-overflow only under ASAN. + +test:like(tostring(cdata_enum), EXPECTED, 'correct tostring result') + +test:done(true) -- 2.45.2