From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: From: Vladislav Shpilevoy Subject: [PATCH 1/1] msgpack: validate msgpack.decode() cdata size argument Date: Fri, 17 May 2019 14:44:25 +0300 Message-Id: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit To: tarantool-patches@freelists.org Cc: vdavydov.dev@gmail.com List-ID: Negative size led to an assertion. The commit adds a check if size is negative. Closes #4224 --- Branch: https://github.com/tarantool/tarantool/tree/gerold103/gh-4224-msgpack-decode-assertion The commit should be cherry-picked to 2.1 and 1.10. src/lua/msgpack.c | 6 +++++- test/app/msgpack.result | 8 ++++++++ test/app/msgpack.test.lua | 6 ++++++ 3 files changed, 19 insertions(+), 1 deletion(-) diff --git a/src/lua/msgpack.c b/src/lua/msgpack.c index 66b83b894..2126988eb 100644 --- a/src/lua/msgpack.c +++ b/src/lua/msgpack.c @@ -336,7 +336,11 @@ lua_msgpack_decode_cdata(lua_State *L, bool check) "a Lua string or 'char *' expected"); } if (check) { - size_t data_len = luaL_checkinteger(L, 2); + ptrdiff_t data_len = luaL_checkinteger(L, 2); + if (data_len < 0) { + return luaL_error(L, "msgpack.decode: size can't be "\ + "negative"); + } const char *p = data; if (mp_check(&p, data + data_len) != 0) return luaL_error(L, "msgpack.decode: invalid MsgPack"); diff --git a/test/app/msgpack.result b/test/app/msgpack.result index 105f503da..a67c05d38 100644 --- a/test/app/msgpack.result +++ b/test/app/msgpack.result @@ -244,3 +244,11 @@ size = msgpack.encode(100, buf) --- - 100 ... +-- +-- gh-4224: msgpack.decode(cdata, size) should check, that size +-- is not negative. +-- +msgpack.decode(ffi.cast('char *', '\x04\x05\x06'), -1) +--- +- error: 'msgpack.decode: size can''t be negative' +... diff --git a/test/app/msgpack.test.lua b/test/app/msgpack.test.lua index de8fd4e37..e0880ac22 100644 --- a/test/app/msgpack.test.lua +++ b/test/app/msgpack.test.lua @@ -78,3 +78,9 @@ buf:reset() size = msgpack.encode(100, buf) (msgpack.decode(ffi.cast('char *', buf.rpos), size)) (msgpack.decode(ffi.cast('const char *', buf.rpos), size)) + +-- +-- gh-4224: msgpack.decode(cdata, size) should check, that size +-- is not negative. +-- +msgpack.decode(ffi.cast('char *', '\x04\x05\x06'), -1) -- 2.20.1 (Apple Git-117)