From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from localhost (localhost [127.0.0.1]) by turing.freelists.org (Avenir Technologies Mail Multiplex) with ESMTP id 48FCA24F35 for ; Mon, 4 Feb 2019 22:30:26 -0500 (EST) Received: from turing.freelists.org ([127.0.0.1]) by localhost (turing.freelists.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MHArVcdoR_kI for ; Mon, 4 Feb 2019 22:30:26 -0500 (EST) Received: from smtp46.i.mail.ru (smtp46.i.mail.ru [94.100.177.106]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by turing.freelists.org (Avenir Technologies Mail Multiplex) with ESMTPS id E61C924FF6 for ; Mon, 4 Feb 2019 22:30:25 -0500 (EST) From: Alexander Turenko Subject: [tarantool-patches] [PATCH v3 1/2] lua-yaml: verify arguments count Date: Tue, 5 Feb 2019 06:30:16 +0300 Message-Id: In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: tarantool-patches-bounce@freelists.org Errors-to: tarantool-patches-bounce@freelists.org Reply-To: tarantool-patches@freelists.org List-help: List-unsubscribe: List-software: Ecartis version 1.0.0 List-Id: tarantool-patches List-subscribe: List-owner: List-post: List-archive: To: Vladislav Shpilevoy Cc: AKhatskevich , tarantool-patches@freelists.org From: AKhatskevich Added arguments count check for yaml.encode() and yaml.decode() functions. Without these checks the functions could read garbage outside of a Lua stack when called w/o arguments. --- test/app-tap/yaml.test.lua | 74 ++++++++++++++++++++++++++++++++++- third_party/lua-yaml/lyaml.cc | 7 ++-- 2 files changed, 77 insertions(+), 4 deletions(-) diff --git a/test/app-tap/yaml.test.lua b/test/app-tap/yaml.test.lua index 4784bb27d..b9bb10720 100755 --- a/test/app-tap/yaml.test.lua +++ b/test/app-tap/yaml.test.lua @@ -130,9 +130,80 @@ local function test_tagged(test, s) "tag prefix on multiple documents") end +local function test_api(test, s) + local encode_usage = 'Usage: encode(object, {tag_prefix = , ' .. + 'tag_handle = })' + local decode_usage = 'Usage: yaml.decode(document, [{tag_only = boolean}])' + + local cases = { + { + 'encode: no args', + func = s.encode, + args = {}, + exp_err = encode_usage, + }, + { + 'encode: wrong opts', + func = s.encode, + args = {{}, 1}, + exp_err = encode_usage, + }, + { + 'encode: wrong tag_prefix', + func = s.encode, + args = {{}, {tag_prefix = 1}}, + exp_err = encode_usage, + }, + { + 'encode: wrong tag_handle', + func = s.encode, + args = {{}, {tag_handle = 1}}, + exp_err = encode_usage, + }, + { + 'encode: extra args', + func = s.encode, + args = {{}, {}, {}}, + exp_err = encode_usage, + }, + { + 'decode: no args', + func = s.decode, + args = {}, + exp_err = decode_usage, + }, + { + 'decode: wrong input', + func = s.decode, + args = {true}, + exp_err = decode_usage, + }, + { + 'decode: wrong opts', + func = s.decode, + args = {'', 1}, + exp_err = decode_usage, + }, + { + 'decode: extra args', + func = s.decode, + args = {'', nil, {}}, + exp_err = decode_usage, + }, + } + + test:plan(#cases) + + for _, case in ipairs(cases) do + local args_len = table.maxn(case.args) + local ok, err = pcall(case.func, unpack(case.args, 1, args_len)) + test:is_deeply({ok, err}, {false, case.exp_err}, case[1]) + end +end + tap.test("yaml", function(test) local serializer = require('yaml') - test:plan(11) + test:plan(12) test:test("unsigned", common.test_unsigned, serializer) test:test("signed", common.test_signed, serializer) test:test("double", common.test_double, serializer) @@ -144,4 +215,5 @@ tap.test("yaml", function(test) test:test("compact", test_compact, serializer) test:test("output", test_output, serializer) test:test("tagged", test_tagged, serializer) + test:test("api", test_api, serializer) end) diff --git a/third_party/lua-yaml/lyaml.cc b/third_party/lua-yaml/lyaml.cc index c6d118a79..354cafe86 100644 --- a/third_party/lua-yaml/lyaml.cc +++ b/third_party/lua-yaml/lyaml.cc @@ -400,7 +400,8 @@ static void load(struct lua_yaml_loader *loader) { */ static int l_load(lua_State *L) { struct lua_yaml_loader loader; - if (! lua_isstring(L, 1)) { + int top = lua_gettop(L); + if (!(top == 1 || top == 2) || !lua_isstring(L, 1)) { usage_error: return luaL_error(L, "Usage: yaml.decode(document, "\ "[{tag_only = boolean}])"); @@ -416,7 +417,7 @@ usage_error: return luaL_error(L, OOM_ERRMSG); yaml_parser_set_input_string(&loader.parser, (yaml_char_t *) document, len); bool tag_only; - if (lua_gettop(L) > 1) { + if (lua_gettop(L) == 2 && ! lua_isnil(L, 2)) { if (! lua_istable(L, 2)) goto usage_error; lua_getfield(L, 2, "tag_only"); @@ -794,7 +795,7 @@ error: static int l_dump(lua_State *L) { struct luaL_serializer *serializer = luaL_checkserializer(L); int top = lua_gettop(L); - if (top > 2) { + if (!(top == 1 || top == 2)) { usage_error: return luaL_error(L, "Usage: encode(object, {tag_prefix = , "\ "tag_handle = })"); -- 2.20.1