mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-11-24 20:31:00 +01:00
Code Issues Projects Releases Wiki Activity

BUG/MEDIUM: lua: segfault when calling haproxy sample fetches from lua

Browse Source 
When a Lua script calls an internal haproxy sample fetch, it may segfault in
some conditions :
- when a fetch has no argument,
- when there is no room left to store the special type ARGT_STOP in the argument
  list (this one shouldn't happen currently as there isn't any sample fetch with
  enough arguments to fill the allocated buffer).

Example of Lua code which reproduces a segfault :
core.register_fetches("segfault", function(txn, ...)
  return txn.req_ver(txn)
end)
This commit is contained in:
Cyril Bont 2015-03-02 00:08:41 +01:00 committed by Willy Tarreau
parent dc0306e3e4
commit 928ae5c822
1 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/hlua.c
View File

@ -2348,15 +2348,15 @@ __LJMP static int hlua_txn_close(lua_State *L)
/* This function is an LUA binding. It is called with each sample-fetch. /* This function is an LUA binding. It is called with each sample-fetch.
* It uses closure argument to store the associated sample-fetch. It * It uses closure argument to store the associated sample-fetch. It
* returns only one argument or throws an error. An error is throwed * returns only one argument or throws an error. An error is thrown
* only if an error is encoutered during the argument parsing. If * only if an error is encountered during the argument parsing. If
* the "sample-fetch" function fails, nil is returned. * the "sample-fetch" function fails, nil is returned.
*/ */
__LJMP static int hlua_run_sample_fetch(lua_State *L) __LJMP static int hlua_run_sample_fetch(lua_State *L)
{ {
struct hlua_txn *s; struct hlua_txn *s;
struct hlua_sample_fetch *f; struct hlua_sample_fetch *f;
struct arg args[ARGM_NBARGS]; struct arg args[ARGM_NBARGS + 1];
int i; int i;
struct sample smp; struct sample smp;
@ -2367,7 +2367,7 @@ __LJMP static int hlua_run_sample_fetch(lua_State *L)
s = MAY_LJMP(hlua_checktxn(L, 1)); s = MAY_LJMP(hlua_checktxn(L, 1));
/* Get extra arguments. */ /* Get extra arguments. */
for (i = 0; i <= lua_gettop(L); i++) { for (i = 0; i < lua_gettop(L) - 1; i++) {
if (i >= ARGM_NBARGS) if (i >= ARGM_NBARGS)
break; break;
hlua_lua2arg(L, i + 2, &args[i]); hlua_lua2arg(L, i + 2, &args[i]);
@ -2377,8 +2377,8 @@ __LJMP static int hlua_run_sample_fetch(lua_State *L)
/* Check arguments. */ /* Check arguments. */
MAY_LJMP(hlua_lua2arg_check(L, 1, args, f->f->arg_mask)); MAY_LJMP(hlua_lua2arg_check(L, 1, args, f->f->arg_mask));
/* Run the special args cehcker. */ /* Run the special args checker. */
if (!f->f->val_args(args, NULL)) { if (f->f->val_args && !f->f->val_args(args, NULL)) {
lua_pushfstring(L, "error in arguments"); lua_pushfstring(L, "error in arguments");
WILL_LJMP(lua_error(L)); WILL_LJMP(lua_error(L));
} }