From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from smtpng2.m.smailru.net (smtpng2.m.smailru.net [94.100.179.3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id 1B68F46970E for ; Fri, 10 Jan 2020 10:28:28 +0300 (MSK) Received: by smtpng2.m.smailru.net with esmtpa (envelope-from ) id 1ipoiZ-0002aV-LB for tarantool-patches@dev.tarantool.org; Fri, 10 Jan 2020 10:28:27 +0300 From: Chris Sosnin Date: Fri, 10 Jan 2020 10:28:26 +0300 Message-Id: <60eeea2fda401b529c78ce139fa05df18f1a12f0.1578640624.git.k.sosnin@tarantool.org> In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Subject: [Tarantool-patches] [PATCH 2/2] tuple: add argument length check for update() List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: tarantool-patches@dev.tarantool.org Currently tuple_object:update() does not check the length of operation string and just takes the first character after decoding. This patch fixes this problem. Follow-up #3884 --- src/box/xrow_update_field.c | 13 ++++++++----- test/box/update.result | 12 ++++++++++++ test/box/update.test.lua | 3 +++ 3 files changed, 23 insertions(+), 5 deletions(-) diff --git a/src/box/xrow_update_field.c b/src/box/xrow_update_field.c index deee91738..7c0f5fb5e 100644 --- a/src/box/xrow_update_field.c +++ b/src/box/xrow_update_field.c @@ -595,9 +595,11 @@ static const struct xrow_update_op_meta op_delete = { }; static inline const struct xrow_update_op_meta * -xrow_update_op_by(char opcode, int op_num) +xrow_update_op_by(const char *opcode, uint32_t len, int op_num) { - switch (opcode) { + if (len != 1) + goto error; + switch (*opcode) { case '=': return &op_set; case '+': @@ -618,7 +620,7 @@ xrow_update_op_by(char opcode, int op_num) } error: diag_set(ClientError, ER_UNKNOWN_UPDATE_OP, op_num, - tt_sprintf("\"%c\"", opcode)); + tt_sprintf("\"%.*s\"", len, opcode)); return NULL; } @@ -659,10 +661,11 @@ xrow_update_op_decode(struct xrow_update_op *op, int op_num, int index_base, "update operation name must be a string"); return -1; } - op->opcode = *mp_decode_str(expr, &len); - op->meta = xrow_update_op_by(op->opcode, op_num); + const char *opcode = mp_decode_str(expr, &len); + op->meta = xrow_update_op_by(opcode, len, op_num); if (op->meta == NULL) return -1; + op->opcode = *opcode; if (arg_count != op->meta->arg_count) { const char *str = tt_sprintf("wrong number of arguments, "\ "expected %u, got %u", diff --git a/test/box/update.result b/test/box/update.result index 7fc0b02c6..28ba47831 100644 --- a/test/box/update.result +++ b/test/box/update.result @@ -834,6 +834,18 @@ s:update({0}, {{'+', 0}}) - error: 'Unknown UPDATE operation #1: wrong number of arguments, expected 3, got 2' ... +s:update({0}, {{'', 2, 1}}) +--- +- error: 'Unknown UPDATE operation #1: ""' +... +s:update({0}, {{'more than 1 character', 2, 1}}) +--- +- error: 'Unknown UPDATE operation #1: "more than 1 character"' +... +s:update({0}, {{'same as previous'}}) +--- +- error: 'Unknown UPDATE operation #1: "same as previous"' +... s:update({0}, {{'+', '+', '+'}}) --- - error: 'Field ''+'' UPDATE error: invalid JSON in position 1' diff --git a/test/box/update.test.lua b/test/box/update.test.lua index 6e8dbd642..314ebef05 100644 --- a/test/box/update.test.lua +++ b/test/box/update.test.lua @@ -252,6 +252,9 @@ s:update({0}, {'+', 2, 2}) s:update({0}, {{}}) s:update({0}, {{'+'}}) s:update({0}, {{'+', 0}}) +s:update({0}, {{'', 2, 1}}) +s:update({0}, {{'more than 1 character', 2, 1}}) +s:update({0}, {{'same as previous'}}) s:update({0}, {{'+', '+', '+'}}) s:update({0}, {{0, 0, 0}}) -- 2.21.0 (Apple Git-122.2)