From: Vladislav Shpilevoy <v.shpilevoy@tarantool.org> To: tarantool-patches@freelists.org Cc: vdavydov.dev@gmail.com Subject: [PATCH 1/1] msgpack: validate msgpack.decode() cdata size argument Date: Fri, 17 May 2019 14:44:25 +0300 [thread overview] Message-ID: <e2c79a1bf8659d01d17eb9fbc5d05bcfcaeb6aef.1558093423.git.v.shpilevoy@tarantool.org> (raw) Negative size led to an assertion. The commit adds a check if size is negative. Closes #4224 --- Branch: https://github.com/tarantool/tarantool/tree/gerold103/gh-4224-msgpack-decode-assertion The commit should be cherry-picked to 2.1 and 1.10. src/lua/msgpack.c | 6 +++++- test/app/msgpack.result | 8 ++++++++ test/app/msgpack.test.lua | 6 ++++++ 3 files changed, 19 insertions(+), 1 deletion(-) diff --git a/src/lua/msgpack.c b/src/lua/msgpack.c index 66b83b894..2126988eb 100644 --- a/src/lua/msgpack.c +++ b/src/lua/msgpack.c @@ -336,7 +336,11 @@ lua_msgpack_decode_cdata(lua_State *L, bool check) "a Lua string or 'char *' expected"); } if (check) { - size_t data_len = luaL_checkinteger(L, 2); + ptrdiff_t data_len = luaL_checkinteger(L, 2); + if (data_len < 0) { + return luaL_error(L, "msgpack.decode: size can't be "\ + "negative"); + } const char *p = data; if (mp_check(&p, data + data_len) != 0) return luaL_error(L, "msgpack.decode: invalid MsgPack"); diff --git a/test/app/msgpack.result b/test/app/msgpack.result index 105f503da..a67c05d38 100644 --- a/test/app/msgpack.result +++ b/test/app/msgpack.result @@ -244,3 +244,11 @@ size = msgpack.encode(100, buf) --- - 100 ... +-- +-- gh-4224: msgpack.decode(cdata, size) should check, that size +-- is not negative. +-- +msgpack.decode(ffi.cast('char *', '\x04\x05\x06'), -1) +--- +- error: 'msgpack.decode: size can''t be negative' +... diff --git a/test/app/msgpack.test.lua b/test/app/msgpack.test.lua index de8fd4e37..e0880ac22 100644 --- a/test/app/msgpack.test.lua +++ b/test/app/msgpack.test.lua @@ -78,3 +78,9 @@ buf:reset() size = msgpack.encode(100, buf) (msgpack.decode(ffi.cast('char *', buf.rpos), size)) (msgpack.decode(ffi.cast('const char *', buf.rpos), size)) + +-- +-- gh-4224: msgpack.decode(cdata, size) should check, that size +-- is not negative. +-- +msgpack.decode(ffi.cast('char *', '\x04\x05\x06'), -1) -- 2.20.1 (Apple Git-117)
next reply other threads:[~2019-05-17 11:44 UTC|newest] Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-05-17 11:44 Vladislav Shpilevoy [this message] 2019-05-20 9:54 ` Vladimir Davydov
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=e2c79a1bf8659d01d17eb9fbc5d05bcfcaeb6aef.1558093423.git.v.shpilevoy@tarantool.org \ --to=v.shpilevoy@tarantool.org \ --cc=tarantool-patches@freelists.org \ --cc=vdavydov.dev@gmail.com \ --subject='Re: [PATCH 1/1] msgpack: validate msgpack.decode() cdata size argument' \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox