From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id 9F0EBEB630F; Mon, 3 Feb 2025 16:32:04 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 9F0EBEB630F DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1738589524; bh=PJDRSe+2FgZSSjC3B0lWH+kvdfdROCz9Yo60ltdryTA=; h=To:Date:Subject:List-Id:List-Unsubscribe:List-Archive:List-Post: List-Help:List-Subscribe:From:Reply-To:Cc:From; b=kbxCqOYYHbH3Zk7l/TJfQoxXNESYvZLMCXyrWOMOamgi7SlcLHDDKNEK3H4lKN/kl n8HhiAOUgCW1ctJSQ0ljZ2rpFZahx+ktYIilWnXA4WA0SZAaYakbfzoty0ZqziZRgS iwQlbdQtUHKDieI3NcMMmqTWOGNQH80JkdXityz0= Received: from send59.i.mail.ru (send59.i.mail.ru [89.221.237.154]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id 1FD2454EB8E for ; Mon, 3 Feb 2025 16:32:04 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 1FD2454EB8E Received: by exim-smtp-6d97ff8cf4-c4zv6 with esmtpa (envelope-from ) id 1tewYU-000000008uf-2rCt; Mon, 03 Feb 2025 16:32:03 +0300 To: Sergey Bronnikov Date: Mon, 3 Feb 2025 16:31:22 +0300 Message-ID: <20250203133122.3617-1-skaplun@tarantool.org> X-Mailer: git-send-email 2.47.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Mailru-Src: smtp X-7564579A: 646B95376F6C166E X-77F55803: 4F1203BC0FB41BD985D89FF3B425BBEF518B0176DCC892F7C9E207D5CA5D8326CD62213F67905E7A2D286A6C083BA70A36F66533C6096EA5BFE04F8DFFD9DA926E5F03F7C95BCAEC08D917D6130B1AFB X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE79961E86438F5BDAEEA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F7900637C218CA8E848E3B7A8638F802B75D45FF36EB9D2243A4F8B5A6FCA7DBDB1FC311F39EFFDF887939037866D6147AF826D86CD1A2AF8D7C309396E6FF94B413955B321DC3EA023CA18ACC7F00164DA146DAFE8445B8C89999728AA50765F7900637D9CFB327BC390E24389733CBF5DBD5E9C8A9BA7A39EFB766F5D81C698A659EA7CC7F00164DA146DA9985D098DBDEAEC8C6602A96AF88C695F6B57BC7E6449061A352F6E88A58FB86F5D81C698A659EA73AA81AA40904B5D9A18204E546F3947C6089696B24BB1D196136E347CC761E074AD6D5ED66289B523666184CF4C3C14F6136E347CC761E07725E5C173C3A84C3A72E408779E4CFDABA3038C0950A5D36B5C8C57E37DE458B330BD67F2E7D9AF16D1867E19FE14079C09775C1D3CA48CF3D321E7403792E342EB15956EA79C166A417C69337E82CC275ECD9A6C639B01B78DA827A17800CE72F88032165008D51731C566533BA786AA5CC5B56E945C8DA X-C1DE0DAB: 0D63561A33F958A530D7B1AB3094683B5002B1117B3ED6964C0351060F6A9D9719AC5B239BAD4335823CB91A9FED034534781492E4B8EEADADEF88395FA75C5FC79554A2A72441328621D336A7BC284946AD531847A6065AED8438A78DFE0A9EBDAD6C7F3747799A X-C8649E89: 1C3962B70DF3F0ADE00A9FD3E00BEEDF77DD89D51EBB7742D3581295AF09D3DF87807E0823442EA2ED31085941D9CD0AF7F820E7B07EA4CFECC3346B44E7F7B0E8F6AFB077B2BC5394AD5F9CBCCAD1A9E357EB0F2FAD7727C69CBF34C6AF1FF5D5D9813428A63F6CB99DCDA4DE53B3B3B8E66560371018289E5461DD406578C05F4332CA8FE04980913E6812662D5F2A5EAB5682573093F7837F15F2B5E4A70B33F2C28C22F508233FCF178C6DD14203 X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu530nj6fImhcD4MUrOEAnl0W826KZ9Q+tr5ycPtXkTV4k65bRjmOUUP8cvGozZ33TWg5HZplvhhXbhDGzqmQDTd6OAevLeAnq3Ra9uf7zvY2zzsIhlcp/Y7m53TZgf2aB4JOg4gkr2biojODHyJtLJ2QiXEWAzjHk0/g== X-Mailru-Sender: 520A125C2F17F0B1A9638AD358559B59D466935F0F011A283DE06ABAFEAF6705901BA348DF584D63B7CBEF92542CD7C88B0A2698F12F5C9EC77752E0C033A69E86920BD37369036789A8C6A0E60D2BB63A5DB60FBEB33A8A0DA7A0AF5A3A8387 X-Mras: Ok Subject: [Tarantool-patches] [PATCH luajit] Reject negative getfenv()/setfenv() levels to prevent compiler warning. X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Sergey Kaplun via Tarantool-patches Reply-To: Sergey Kaplun Cc: tarantool-patches@dev.tarantool.org Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" From: Mike Pall Thanks to Sergey Kaplun. (cherry picked from commit 9d777346bc4e3b033dd78393980d41ee7bc34867) When the number represented the level value is given to the `getfenv()`/`setfenv()`, it is cast to the `int`. Assume the given value is `2^31`, i.e. the resulting value after the cast is `INT_MIN`. After this, it will be decremented in `lj_debug_level()` and underflowed to the `INT_MAX`. That produces the UBSan warning about signed integer overflow. This patch raises the error early in the aforementioned functions, since a negative level value is meaningless. Sergey Kaplun: * added the description and the test for the problem Part of tarantool/tarantool#11055 --- Branch: https://github.com/tarantool/luajit/tree/skaplun/lj-1329-getfenv-setfenv-negative Related issues: * https://github.com/tarantool/tarantool/issues/11055 * https://github.com/LuaJIT/LuaJIT/issues/1329 src/lib_base.c | 4 +++ .../lj-1329-getfenv-setfenv-negative.test.lua | 27 +++++++++++++++++++ 2 files changed, 31 insertions(+) create mode 100644 test/tarantool-tests/lj-1329-getfenv-setfenv-negative.test.lua diff --git a/src/lib_base.c b/src/lib_base.c index ad151975..23728d6c 100644 --- a/src/lib_base.c +++ b/src/lib_base.c @@ -144,6 +144,8 @@ LJLIB_CF(getfenv) LJLIB_REC(.) cTValue *o = L->base; if (!(o < L->top && tvisfunc(o))) { int level = lj_lib_optint(L, 1, 1); + if (level < 0) + lj_err_arg(L, 1, LJ_ERR_INVLVL); o = lj_debug_frame(L, level, &level); if (o == NULL) lj_err_arg(L, 1, LJ_ERR_INVLVL); @@ -166,6 +168,8 @@ LJLIB_CF(setfenv) setgcref(L->env, obj2gco(t)); return 0; } + if (level < 0) + lj_err_arg(L, 1, LJ_ERR_INVLVL); o = lj_debug_frame(L, level, &level); if (o == NULL) lj_err_arg(L, 1, LJ_ERR_INVLVL); diff --git a/test/tarantool-tests/lj-1329-getfenv-setfenv-negative.test.lua b/test/tarantool-tests/lj-1329-getfenv-setfenv-negative.test.lua new file mode 100644 index 00000000..bc10c16f --- /dev/null +++ b/test/tarantool-tests/lj-1329-getfenv-setfenv-negative.test.lua @@ -0,0 +1,27 @@ +local tap = require('tap') + +-- The test file to demonstrate UBSan warning for `setfenv()` and +-- `getfenv()` with a huge `level` value. +-- See also: https://github.com/LuaJIT/LuaJIT/issues/1329. +local test = tap.test('lj-1329-getfenv-setfenv-negative') + +test:plan(4) + +-- This number will be equal to `INT_MIN` when casted to `int`. +-- After this, it will be decremented in `lj_debug_level()` and +-- underflowed to the `INT_MAX`. That produces the UBSan warning +-- about signed integer overflow. +local LEVEL = 2 ^ 31 +local ERRMSG = 'invalid level' + +-- Tests check the UBSan runtime error. Add assertions just to be +-- sure that we don't change the behaviour. +local status, errmsg = pcall(getfenv, LEVEL) +test:ok(not status, 'getfenv: correct status') +test:like(errmsg, ERRMSG, 'getfenv: correct error message') + +status, errmsg = pcall(setfenv, LEVEL, {}) +test:ok(not status, 'setfenv: correct status') +test:like(errmsg, ERRMSG, 'setfenv: correct error message') + +test:done(true) -- 2.47.1