From 10873f164d2abe8c6ff2d8491f0b2df578b80142 Mon Sep 17 00:00:00 2001
From: Vladislav Shpilevoy <v.shpilevoy@tarantool.org>
Date: Fri, 17 May 2019 14:42:19 +0300
Subject: [PATCH] msgpack: validate msgpack.decode() cdata size argument
Negative size led to an assertion. The commit adds a check if
size is negative.
Closes #4224
---
src/lua/msgpack.c | 6 +++++-
test/app/msgpack.result | 8 ++++++++
test/app/msgpack.test.lua | 6 ++++++
3 files changed, 19 insertions(+), 1 deletion(-)
diff --git a/src/lua/msgpack.c b/src/lua/msgpack.c
index 66b83b894a..2126988ebe 100644
--- a/src/lua/msgpack.c
+++ b/src/lua/msgpack.c
@@ -336,7 +336,11 @@ lua_msgpack_decode_cdata(lua_State *L, bool check)
"a Lua string or 'char *' expected");
}
if (check) {
- size_t data_len = luaL_checkinteger(L, 2);
+ ptrdiff_t data_len = luaL_checkinteger(L, 2);
+ if (data_len < 0) {
+ return luaL_error(L, "msgpack.decode: size can't be "\
+ "negative");
+ }
const char *p = data;
if (mp_check(&p, data + data_len) != 0)
return luaL_error(L, "msgpack.decode: invalid MsgPack");
diff --git a/test/app/msgpack.result b/test/app/msgpack.result
index 105f503da7..a67c05d38a 100644
--- a/test/app/msgpack.result
+++ b/test/app/msgpack.result
@@ -244,3 +244,11 @@ size = msgpack.encode(100, buf)
---
- 100
...
+--
+-- gh-4224: msgpack.decode(cdata, size) should check, that size
+-- is not negative.
+--
+msgpack.decode(ffi.cast('char *', '\x04\x05\x06'), -1)
+---
+- error: 'msgpack.decode: size can''t be negative'
+...
diff --git a/test/app/msgpack.test.lua b/test/app/msgpack.test.lua
index de8fd4e376..e0880ac226 100644
--- a/test/app/msgpack.test.lua
+++ b/test/app/msgpack.test.lua
@@ -78,3 +78,9 @@ buf:reset()
size = msgpack.encode(100, buf)
(msgpack.decode(ffi.cast('char *', buf.rpos), size))
(msgpack.decode(ffi.cast('const char *', buf.rpos), size))
+
+--
+-- gh-4224: msgpack.decode(cdata, size) should check, that size
+-- is not negative.
+--
+msgpack.decode(ffi.cast('char *', '\x04\x05\x06'), -1)
--
GitLab