From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id A4DB06687D1; Fri, 20 Oct 2023 16:18:45 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org A4DB06687D1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1697807925; bh=Om6QcZyUaKxhEQ8RKA3yFFcEVXtzPGjVZsVHQTyILok=; h=To:Date:In-Reply-To:References:Subject:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To: From; b=a/RO9RDaY6f83sEDVjwOZLFuk+ONwZPcWs1/aL6Lna/XB+N5Iw/6XUQBwIg3SgDkh fxiZta/CQJ9iqhe955k2Or1ZwWAv40LWh387scmivnP6QXKPJRRFk8F+HHv820WTZh TTyESgyf44WuNAjYqugFOAJV/KQMiRaIFd/ZWJA8= Received: from mail-ed1-f42.google.com (mail-ed1-f42.google.com [209.85.208.42]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id 1B2EB6687D1 for ; Fri, 20 Oct 2023 16:18:35 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 1B2EB6687D1 Received: by mail-ed1-f42.google.com with SMTP id 4fb4d7f45d1cf-53f9af41444so1218603a12.1 for ; Fri, 20 Oct 2023 06:18:35 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1697807914; x=1698412714; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=OvgnJy2PS5rOOL5dbJQjF4EBnAPGPSZy6NIg209eqeg=; b=QZTsAm36m3NkWDt54equ5AR+x2OKSrrxB1zIeZF47hnzAWlTlFRUhU/svjaXdvJGMv RBGT8f4q8u9y1ZVey9JlFeR7+6du0fAg96bsMJJeEaQNs8GliqsITLIvo8MgpKabufcu QWA3v/rbr7gnvObEQqcm9S7r257uOE8BydjTmB/qHyxpyfGvC3h+x8nnFV+ChePU6V9J VysBVx0C3PWeb5bDa3A+SxiQCvLBpyAlnxL4ulmpu24Gg6wztRRX9OhhO3Vaoe91FfGt z/spjM55tcfzOzNtgbDSQJAobIa7qufWHr1MWzu4HMdjX3108jaDqkU000rD+YHP5Vh+ ARyA== X-Gm-Message-State: AOJu0YyYZ2D7kzTCGIvuPnUlLm5Sib6kjAbB7YKmuwHKZRjwq+5Vf1r7 DH0wEl6qPbSs+2NKQVFlwlhfu9K/jbymcg== X-Google-Smtp-Source: AGHT+IF0tWQRdZ6dJySd+lYRbBgD/xjHMohtePLSw+MvYLDHGKsP4mVZprUpyAVzUoTYq42HtkyBnQ== X-Received: by 2002:a17:907:2d08:b0:9bf:d65d:dc0f with SMTP id gs8-20020a1709072d0800b009bfd65ddc0fmr1118088ejc.4.1697807913827; Fri, 20 Oct 2023 06:18:33 -0700 (PDT) Received: from pony.. ([185.6.247.97]) by smtp.gmail.com with ESMTPSA id qh12-20020a170906ecac00b009b9af27d98csm1478598ejb.132.2023.10.20.06.18.32 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 20 Oct 2023 06:18:33 -0700 (PDT) To: tarantool-patches@dev.tarantool.org, Sergey Kaplun , max.kokryashkin@gmail.com, Igor Munkin Date: Fri, 20 Oct 2023 16:17:23 +0300 Message-Id: X-Mailer: git-send-email 2.34.1 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Subject: [Tarantool-patches] [PATCH luajit 2/2][v3] Followup fix for embedded bytecode loader. X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Sergey Bronnikov via Tarantool-patches Reply-To: Sergey Bronnikov Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" From: Mike Pall (cherry-picked from commit e49863eda13d095b1a78fd4ca0fd3a6a9a17d782) The patch follows up a previous patch and limits the total size of a chunk load by `lua_load` with size `LJ_MAX_BUF - 1`. The proposed test `lj-549-lua-load.test` checks corner cases in `lua_load` function and covers this and the previous patch partially. Sergey Bronnikov: * added the description and the test Part of tarantool/tarantool#9145 --- src/lj_lex.c | 1 + test/tarantool-c-tests/lj-549-lua-load.test.c | 111 ++++++++++++++++++ 2 files changed, 112 insertions(+) create mode 100644 test/tarantool-c-tests/lj-549-lua-load.test.c diff --git a/src/lj_lex.c b/src/lj_lex.c index 6291705f..13495c41 100644 --- a/src/lj_lex.c +++ b/src/lj_lex.c @@ -51,6 +51,7 @@ static LJ_NOINLINE LexChar lex_more(LexState *ls) if (sz >= LJ_MAX_BUF) { if (sz != ~(size_t)0) lj_err_mem(ls->L); sz = ~(uintptr_t)0 - (uintptr_t)p; + if (sz >= LJ_MAX_BUF) sz = LJ_MAX_BUF-1; ls->endmark = 1; } ls->pe = p + sz; diff --git a/test/tarantool-c-tests/lj-549-lua-load.test.c b/test/tarantool-c-tests/lj-549-lua-load.test.c new file mode 100644 index 00000000..74eaf716 --- /dev/null +++ b/test/tarantool-c-tests/lj-549-lua-load.test.c @@ -0,0 +1,111 @@ +#include "test.h" +#include "utils.h" + +#include "lj_def.h" + +#define UNUSED(x) ((void)(x)) + +/* + * Function generates a huge chunk of "bytecode" with a size + * bigger than LJ_MAX_BUF. The generated chunk must enable + * endmark in a Lex state. + */ +static const char * +bc_reader_with_endmark(lua_State *L, void *data, size_t *size) +{ + UNUSED(data); + *size = ~(size_t)0; + + return NULL; +} + +static int bc_loader_with_endmark(void *test_state) +{ + lua_State *L = test_state; + void *ud = NULL; + int res = lua_load(L, bc_reader_with_endmark, ud, "endmark"); + + /* + * Make sure we passed the condition with lj_err_mem + * in the function `lex_more`. + */ + assert_true(res != LUA_ERRMEM); + assert_true(lua_gettop(L) == 1); + lua_settop(L, 0); + + return TEST_EXIT_SUCCESS; +} + +enum bc_emission_state { + EMIT_BC, + EMIT_EOF, +}; + +typedef struct { + enum bc_emission_state state; +} dt; + +/* + * Function returns the bytecode chunk on the first call and NULL + * and size equal to zero on the second call. Triggers the flag + * `END_OF_STREAM` in the function `lex_more`. + */ +static const char * +bc_reader_with_eof(lua_State *L, void *data, size_t *size) +{ + UNUSED(L); + dt *test_data = (dt *)data; + if (test_data->state == EMIT_EOF) { + *size = 0; + return NULL; + } + + static char *bc_chunk = NULL; + + /* + * Minimal size of a buffer with bytecode: + * signature (1 byte) and a bytecode itself (1 byte). + */ + size_t sz = 2; + free(bc_chunk); + bc_chunk = malloc(sz); + /* + * `lua_load` automatically detects whether the chunk is text + * or binary and loads it accordingly. We need a trace for + * *bytecode* input, so it is necessary to deceive a check in + * `lj_lex_setup`, that makes a sanity check and detects + * whether input is bytecode or text by the first char. + * Put `LUA_SIGNATURE[0]` at the beginning of the allocated + * region. + */ + bc_chunk[0] = LUA_SIGNATURE[0]; + *size = sz; + test_data->state = EMIT_EOF; + + return bc_chunk; +} + +static int bc_loader_with_eof(void *test_state) +{ + lua_State *L = test_state; + dt test_data = {0}; + test_data.state = EMIT_BC; + int res = lua_load(L, bc_reader_with_eof, &test_data, "eof"); + assert_true(res == LUA_ERRSYNTAX); + lua_settop(L, 0); + + return TEST_EXIT_SUCCESS; +} + +int main(void) +{ + lua_State *L = utils_lua_init(); + const struct test_unit tgroup[] = { + test_unit_def(bc_loader_with_endmark), + test_unit_def(bc_loader_with_eof) + }; + + const int test_result = test_run_group(tgroup, L); + utils_lua_close(L); + return test_result; +} -- 2.34.1