From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id 1FE3D57649D; Wed, 9 Aug 2023 18:49:00 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 1FE3D57649D DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1691596140; bh=JuKrwA+Ag84mQOzylM/NSsTVOFKMz8wc+bn00W69hWo=; h=To:Date:In-Reply-To:References:Subject:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:Cc: From; b=fWi4b04iT9gWXmbkvoCwyFKFVpQ7Aklok0USR7a5e6RVJkFWOc1ec7dES/wPJuBQ4 9FOf+fyLMnzjhVJV6HIKw3NcxgC3Dagnrjtz9+Fkew1QBjAK0wiT4WojcR8mVtZqBu zl8h8O0ao5s2Hvk5Xc8nKeLhJbP12ChSN06AYrCk= Received: from smtp32.i.mail.ru (smtp32.i.mail.ru [95.163.41.73]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id 2181057649D for ; Wed, 9 Aug 2023 18:41:20 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 2181057649D Received: by smtp32.i.mail.ru with esmtpa (envelope-from ) id 1qTlJH-003Nbf-1S; Wed, 09 Aug 2023 18:41:19 +0300 To: Igor Munkin , Sergey Bronnikov Date: Wed, 9 Aug 2023 18:36:05 +0300 Message-ID: X-Mailer: git-send-email 2.41.0 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Mailru-Src: smtp X-4EC0790: 10 X-7564579A: 646B95376F6C166E X-77F55803: 4F1203BC0FB41BD969E04B5EED670DC836E8CADCCFC7EB90264FE23C7F795239182A05F53808504090E1BDD2D8EBDCC339BC923D1AD8FECE376F36D5B08BD721B9848BEE4465EBB8 X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE75263010198C72082EA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F79006370E2FF649BDAFCC308638F802B75D45FF36EB9D2243A4F8B5A6FCA7DBDB1FC311F39EFFDF887939037866D6147AF826D83F0326EF1372C336B7D36117800D1738117882F4460429724CE54428C33FAD305F5C1EE8F4F765FC89C3E995CBB71A93A471835C12D1D9774AD6D5ED66289B52BA9C0B312567BB23117882F4460429728776938767073520140C956E756FBB7A6FD1C55BDD38FC3FD2E47CDBA5A96583BA9C0B312567BB2376E601842F6C81A19E625A9149C048EE26055571C92BF10FA68A47777D5C6D9CD8FC6C240DEA76429C9F4D5AE37F343AA9539A8B242431040A6AB1C7CE11FEE36089696B24BB1D199735652A29929C6CC4224003CC836476E2F48590F00D11D6E2021AF6380DFAD1A18204E546F3947CB11811A4A51E3B096D1867E19FE1407959CC434672EE6371089D37D7C0E48F6C8AA50765F7900637BBEA499411984DA1EFF80C71ABB335746BA297DBC24807EABDAD6C7F3747799A X-C1DE0DAB: 0D63561A33F958A5A9B4B97DBC90A8F82F6BEBBAB7CE8134DBA333413C0F5145F87CCE6106E1FC07E67D4AC08A07B9B0F254576263B31EA99C5DF10A05D560A950611B66E3DA6D700B0A020F03D25A0997E3FB2386030E77 X-C8649E89: 1C3962B70DF3F0ADBF74143AD284FC7177DD89D51EBB7742424CF958EAFF5D571004E42C50DC4CA955A7F0CF078B5EC49A30900B95165D3419891600CCEF4607DD48115C05AB07518DC21E69709D82FE25FC9A93958D8965382775D27CC96C361D7E09C32AA3244CB213A49B90888D291B954E5D1C523676FE8DA44ABE2443F7BAD658CF5C8AB4025DA084F8E80FEBD3202CD0F03380D9577A83BD0C44CE203720ABEDE4BBDD9CDD X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu530nj6fImhcD4MUrOEAnl0W826KZ9Q+tr5ycPtXkTV4k65bRjmOUUP8cvGozZ33TWg5HZplvhhXbhDGzqmQDTd6OAevLeAnq3Ra9uf7zvY2zzsIhlcp/Y7m53TZgf2aB4JOg4gkr2biojUzxoxvtYX2pzkQtY1/qmkA== X-Mailru-Sender: 11C2EC085EDE56FAC07928AF2646A769AF9F9E3D0E13135239BC923D1AD8FECEE5E949923882BAADDEDBA653FF35249392D99EB8CC7091A70E183A470755BFD208F19895AA18418972D6B4FCE48DF648AE208404248635DF X-Mras: Ok Subject: [Tarantool-patches] [PATCH luajit 16/19] Prevent integer overflow while parsing long strings. X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Sergey Kaplun via Tarantool-patches Reply-To: Sergey Kaplun Cc: tarantool-patches@dev.tarantool.org Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" From: Mike Pall (cherry-picked from commit 16e5605eec2e3882d709c6b123a644f6a8023945) This commit fixes possible integer overflow of the separator's length counter during parsing long strings. It may lead to the fact, that parser considers a string with unbalanced long brackets to be correct. Since this is pointless to parse too long string separators in the hope, that the string is correct, just use hardcoded limit (2 ^ 25 is enough). Be aware that this limit is different for Lua 5.1. We can't check the string overflow itself without a really large file, because the ERR_MEM error will be raised, due to the string buffer reallocations during parsing. Keep such huge file in the repo is pointless, so just check that we don't parse long string after aforementioned separator length. Sergey Kaplun: * added the description and the test for the problem Part of tarantool/tarantool#8825 --- src/lj_lex.c | 2 +- .../lj-812-too-long-string-separator.test.lua | 31 +++++++++++++++++++ 2 files changed, 32 insertions(+), 1 deletion(-) create mode 100644 test/tarantool-tests/lj-812-too-long-string-separator.test.lua diff --git a/src/lj_lex.c b/src/lj_lex.c index 52856912..c66660d7 100644 --- a/src/lj_lex.c +++ b/src/lj_lex.c @@ -138,7 +138,7 @@ static int lex_skipeq(LexState *ls) int count = 0; LexChar s = ls->c; lua_assert(s == '[' || s == ']'); - while (lex_savenext(ls) == '=') + while (lex_savenext(ls) == '=' && count < 0x20000000) count++; return (ls->c == s) ? count : (-count) - 1; } diff --git a/test/tarantool-tests/lj-812-too-long-string-separator.test.lua b/test/tarantool-tests/lj-812-too-long-string-separator.test.lua new file mode 100644 index 00000000..fda69d17 --- /dev/null +++ b/test/tarantool-tests/lj-812-too-long-string-separator.test.lua @@ -0,0 +1,31 @@ +local tap = require('tap') + +-- Test to check that we avoid parsing of too long separator +-- for long strings. +-- See also the discussion in the +-- https://github.com/LuaJIT/LuaJIT/issues/812. + +local test = tap.test('lj-812-too-long-string-separator'):skipcond({ + ['Test requires GC64 mode enabled'] = not require('ffi').abi('gc64'), +}) +test:plan(2) + +-- We can't check the string overflow itself without a really +-- large file, because the ERR_MEM error will be raised, due to +-- the string buffer reallocations during parsing. +-- Keep such huge file in the repo is pointless, so just check +-- that we don't parse long string after some separator length. +-- Be aware that this limit is different for Lua 5.1. + +-- Use the hardcoded limit. The same as in the . +local separator = string.rep('=', 0x20000000 + 1) +local test_str = ('return [%s[]%s]'):format(separator, separator) + +local f, err = loadstring(test_str, 'empty_str_f') +test:ok(not f, 'correct status when parsing string with too long separator') + +-- Check error message. +test:ok(tostring(err):match('invalid long string delimiter'), + 'correct error when parsing string with too long separator') + +test:done(true) -- 2.41.0