From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id DA2376ECCD; Mon, 20 Jul 2026 16:00:00 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org DA2376ECCD DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1784552401; bh=0XBqEnUhEHs2uhD4BM7iYt59gssnNe5JhKIAJInYqTY=; h=To:Date:Subject:List-Id:List-Unsubscribe:List-Archive:List-Post: List-Help:List-Subscribe:From:Reply-To:Cc:From; b=n7btuLdXveXpOeHWAiWKHm6W2+cng/RIy04rNdMbaI8SwT8t+7iaI5wu2fOoQ9Hu7 m7sToU70NFY+Pqmu0/bQ2PVzGaVBEcBccBrS9hS1oyGIeITnrH1Noy/idIpDpftns2 5f2VPs0F0j6pjfEAs+u6nDb0qFX1ARJfICql+8kY= Received: from send150.i.mail.ru (send150.i.mail.ru [89.221.237.245]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id 49F966ECCD for ; Mon, 20 Jul 2026 15:59:59 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 49F966ECCD Received: by exim-smtp-77575cb4cb-pnhj9 with esmtpa (envelope-from ) id 1wlnbC-00000000CZZ-0Nq1; Mon, 20 Jul 2026 15:59:58 +0300 To: Sergey Bronnikov , Evgeniy Temirgaleev Date: Mon, 20 Jul 2026 15:59:43 +0300 Message-ID: <20260720125943.2531443-1-skaplun@tarantool.org> X-Mailer: git-send-email 2.55.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Mailru-Src: smtp X-7564579A: 646B95376F6C166E X-77F55803: 4F1203BC0FB41BD9C2A6B03AB739174C668359D67192725935F5B468A906044B00894C459B0CD1B916CCE4CC9BC8C9F70578E6996F383413C0BA5AD349D4A558BB9F519901D4B28D1BB59B39F4C00062 X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE783C1FBFE215D363AEA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F7900637AC83A81C8FD4AD23D82A6BABE6F325AC2E85FA5F3EDFCBAA7353EFBB5533756661848894E0D3EACE27F7837D6E4A6C11EFEA9FCAA457ADB854A4221E9535DD75389733CBF5DBD5E913377AFFFEAFD269176DF2183F8FC7C03F781F11CD20E21D8941B15DA834481FCF19DD082D7633A0EF3E4896CB9E6436389733CBF5DBD5E9D5E8D9A59859A8B67C48477FF724415ECC7F00164DA146DA6F5DAA56C3B73B237318B6A418E8EAB8D32BA5DBAC0009BE9E8FC8737B5C224985459AAAFBFFF4DC76E601842F6C81A12EF20D2F80756B5FB606B96278B59C4276E601842F6C81A127C277FBC8AE2E8BB3207FF740891A4E3AA81AA40904B5D99C9F4D5AE37F343AD1F44FA8B9022EA23BBE47FD9DD3FB595F5C1EE8F4F765FCF1175FABE1C0F9B6E2021AF6380DFAD18AA50765F790063735872C767BF85DA227C277FBC8AE2E8BD9166E38712C78CA75ECD9A6C639B01B4E70A05D1297E1BBCB5012B2E24CD356 X-C1DE0DAB: 0D63561A33F958A55FF96897FD2A68EA5002B1117B3ED696BE926C6F310B5B6FF09842853758E9E5823CB91A9FED034534781492E4B8EEAD1DEE520572A35377C79554A2A72441328621D336A7BC284946AD531847A6065A535571D14F44ED41 X-C8649E89: 1C3962B70DF3F0AD73CAD6646DEDE191716CD42B3DD1D34C77DD89D51EBB774225B6776AC983F447FC0B9F89525902EE6F57B2FD27647F25E66C117BDB76D65948E39E0DD50FD662D4F187D500D23B8DAE2F87E797A04471F7F688BF4BC2A6F80DDE3196A77604DFB8341EE9D5BE9A0A39A40B82D23CBAB304F2E695C350D8D554B0440D17CF1BB8C7CEAA0681F5848F4C41F94D744909CECFA6C6B0C050A61A8CAF69B82BA93681CD72808BE417F3B9E0E7457915DAA85F X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu53w8ahmwBjZKM/YPHZyZHvz5uv+WouB9+ObcCpyrx6l7KImUglyhkEat/+ysWwi0gdhEs0JGjl6ggRWTy1haxBpVdbIX1nthFXMZebaIdHP2ghjoIc/363UZI6Kf1ptIMVWmxowtcrDwUabwCHfVtwec= X-Mailru-Sender: 520A125C2F17F0B17094CDC02B85F11B89127FEA820407373DE06ABAFEAF6705B90B8B3B81EAC5A2B7CBEF92542CD7C88B0A2698F12F5C9EC77752E0C033A69E86920BD37369036789A8C6A0E60D2BB63A5DB60FBEB33A8A0DA7A0AF5A3A8387 X-Mras: Ok Subject: [Tarantool-patches] [PATCH luajit] FFI: Shrink container of packed bitfield. X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Sergey Kaplun via Tarantool-patches Reply-To: Sergey Kaplun Cc: tarantool-patches@dev.tarantool.org Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" From: Mike Pall Reported by Huang Haiyang. (cherry picked from commit e4c7d8b38040518d42599eef8ddb5e67aa967a9c) The bitfield of packed structure uses the original type size, which leads to heap-buffer-overflow access on conversions. This patch fixes it by adjusting the size of the bitfield container when necessary. Sergey Kaplun: * added the description and the test for the problem Part of tarantool/tarantool#12880 --- Branch: https://github.com/tarantool/luajit/tree/skaplun/lj-1451-ffi-packed-bitfield Related issues: * https://github.com/LuaJIT/LuaJIT/issues/1451 * https://github.com/tarantool/tarantool/issues/12880 src/lj_cparse.c | 2 ++ .../lj-1451-ffi-packed-bitfield.test.lua | 28 +++++++++++++++++++ 2 files changed, 30 insertions(+) create mode 100644 test/tarantool-tests/lj-1451-ffi-packed-bitfield.test.lua diff --git a/src/lj_cparse.c b/src/lj_cparse.c index ff23b44b..1b3ce7ec 100644 --- a/src/lj_cparse.c +++ b/src/lj_cparse.c @@ -1341,6 +1341,8 @@ static void cp_struct_layout(CPState *cp, CTypeID sid, CTInfo sattr) CTALIGN(lj_fls(sz)); ct->size = (bofs >> 3); /* Store field offset. */ } else { + if (csz > amask+1 && bsz <= amask+1) + csz = amask+1; /* Shrink container of packed bitfield. */ ct->info = CTINFO(CT_BITFIELD, (info & (CTF_QUAL|CTF_UNSIGNED|CTF_BOOL)) + (csz << (CTSHIFT_BITCSZ-3)) + (bsz << CTSHIFT_BITBSZ)); diff --git a/test/tarantool-tests/lj-1451-ffi-packed-bitfield.test.lua b/test/tarantool-tests/lj-1451-ffi-packed-bitfield.test.lua new file mode 100644 index 00000000..07e53f76 --- /dev/null +++ b/test/tarantool-tests/lj-1451-ffi-packed-bitfield.test.lua @@ -0,0 +1,28 @@ +local tap = require('tap') + +-- Test file to demonstrate LuaJIT's incorrect behaviour of the +-- `#pragma` pack directive for bitfields in structures. +-- See also: https://github.com/LuaJIT/LuaJIT/issues/1451. + +local test = tap.test('lj-1451-ffi-packed-bitfield') + +local ffi = require('ffi') + +ffi.cdef[[ +#pragma pack(push, 2) +typedef struct { + unsigned int bitfield:1; +} packed_struct; +#pragma pack(pop) +]] + +test:plan(2) + +local packed = ffi.new('packed_struct') + +test:is(packed.bitfield, 0, 'correct 0-initialization') + +packed.bitfield = 1 +test:is(packed.bitfield, 1, 'bitfield set correctly') + +test:done(true) -- 2.55.0