Merge branch 'stable' of https://github.com/tarantool/tarantool into stable

src/box/tuple.cc

@@ -374,14 +374,24 @@ tuple_update(struct tuple_format *format,
 	return new_tuple;
 }
 
+static inline void
+tuple_verify_data(const char **begin, const char *end, uint32_t field_count)
+{
+	while (*begin < end && field_count-- > 0) {
+		size_t len = load_varint32(begin);
+		*begin += len;
+	}
+	if (field_count > 0 || *begin != end)
+		tnt_raise(IllegalParams, "during verifying tuple: incorrect tuple format");
+}
+
 struct tuple *
 tuple_new(struct tuple_format *format, uint32_t field_count,
 	  const char **data, const char *end)
 {
 	size_t tuple_len = end - *data;
 
-	if (tuple_len != tuple_range_size(data, end, field_count))
-		tnt_raise(IllegalParams, "tuple_new(): incorrect tuple format");
+	tuple_verify_data(data, end, field_count);
 
 	struct tuple *new_tuple = tuple_alloc(format, tuple_len);
 	new_tuple->field_count = field_count;

src/box/tuple.h

@@ -306,17 +306,6 @@ static inline size_t tuple_len(struct tuple *tuple)
 		sizeof(tuple->field_count);
 }
 
-static inline size_t
-tuple_range_size(const char **begin, const char *end, uint32_t count)
-{
-	const char *start = *begin;
-	while (*begin < end && count-- > 0) {
-		size_t len = load_varint32(begin);
-		*begin += len;
-	}
-	return *begin - start;
-}
-
 void tuple_free(struct tuple *tuple);
 
 /**

test/box/lua.test

@@ -63,6 +63,9 @@ exec sql "call f1()"
 exec admin "lua function f1() return f1 end"
 exec sql "call f1()"
 
+# Test case for gh-140, crash with wrong box.process(..) call
+exec admin "lua box.process(13, box.pack('iiippp', 0, 0, 99999, 99999, 'wrong', 'tuple'))"
+
 exec sql "insert into t0 values (1, 'test box delete')"
 exec sql "call box.delete('0', '\1\0\0\0')"
 exec sql "call box.delete('0', '\1\0\0\0')"