BUG/MINOR: lua: set buffer size during map lookups
authorThierry Fournier <thierry.fournier@ozon.io>
Tue, 10 Nov 2020 19:38:20 +0000 (20:38 +0100)
committerChristopher Faulet <cfaulet@haproxy.com>
Fri, 13 Nov 2020 15:51:19 +0000 (16:51 +0100)
This size is used by some pattern matching to determine if there
is sufficient room in the buffer to add final \0 if necessary.
If the size is not set, the conditions use uninitialized value.

Note: it seems this bug can't cause a crash.

Should be backported until 2.2 (at least)

(cherry picked from commit 91dc0c0d8fdc2fb091b49699ebb323d01aa1d9f6)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
(cherry picked from commit 66e9ff531481d6a043ea402cb303f36b3d9ca9e1)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
(cherry picked from commit 4fa0bdfbb3357af1d08b55ed5f7db912225c25f3)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>

src/hlua.c

index bb0a8f3..5377fbb 100644 (file)
@@ -1631,6 +1631,7 @@ __LJMP static inline int _hlua_map_lookup(struct lua_State *L, int str)
                smp.data.type = SMP_T_STR;
                smp.flags = SMP_F_CONST;
                smp.data.u.str.area = (char *)MAY_LJMP(luaL_checklstring(L, 2, (size_t *)&smp.data.u.str.data));
+               smp.data.u.str.size = smp.data.u.str.data + 1;
        }
 
        pat = pattern_exec_match(&desc->pat, &smp, 1);