1berry/haproxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

BUG/MINOR: hlua: fix invalid use of lua_pop on error paths

Browse Source 
Multiple error paths made invalid use of lua_pop():

When the stack is emptied using lua_settop(0), lua_pop() (which is
implemented as a lua_settop() macro) should not be used right after,
because it could lead to invalid reads since the stack is already empty.

Unfortunately, some remnants from initial lua stack implementation kept
doing so, resulting in haproxy crashs on some lua runtime errors paths
from time to time (ie: ERRRUN, ERRMEM).

Moreover, the extra lua_pop() instruction, even if it was safe, is totally
pointless in such case.

Removing such unsafe lua_pop() statements when we know that the stack is
already empty.

This must be backported in every stable versions.
This commit is contained in:
Aurelien DARRAGON 2023-08-09 10:11:49 +02:00 committed by Willy Tarreau
parent 7f80d51812
commit 12cf8d4db7
1 changed files with 1 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/hlua.c
View File

@ -1777,7 +1777,6 @@ resume_execution:
} }
msg = lua_tostring(lua->T, -1); msg = lua_tostring(lua->T, -1);
lua_settop(lua->T, 0); /* Empty the stack. */ lua_settop(lua->T, 0); /* Empty the stack. */
lua_pop(lua->T, 1);
trace = hlua_traceback(lua->T, ", "); trace = hlua_traceback(lua->T, ", ");
if (msg) if (msg)
lua_pushfstring(lua->T, "[state-id %d] runtime error: %s from %s", lua->state_id, msg, trace); lua_pushfstring(lua->T, "[state-id %d] runtime error: %s from %s", lua->state_id, msg, trace);
@ -1800,7 +1799,6 @@ resume_execution:
} }
msg = lua_tostring(lua->T, -1); msg = lua_tostring(lua->T, -1);
lua_settop(lua->T, 0); /* Empty the stack. */ lua_settop(lua->T, 0); /* Empty the stack. */
lua_pop(lua->T, 1);
if (msg) if (msg)
lua_pushfstring(lua->T, "[state-id %d] message handler error: %s", lua->state_id, msg); lua_pushfstring(lua->T, "[state-id %d] message handler error: %s", lua->state_id, msg);
else else
@ -12907,7 +12905,6 @@ int hlua_post_init_state(lua_State *L)
kind = "runtime error"; kind = "runtime error";
msg = lua_tostring(L, -1); msg = lua_tostring(L, -1);
lua_settop(L, 0); /* Empty the stack. */ lua_settop(L, 0); /* Empty the stack. */
lua_pop(L, 1);
trace = hlua_traceback(L, ", "); trace = hlua_traceback(L, ", ");
if (msg) if (msg)
ha_alert("Lua init: %s: '%s' from %s\n", kind, msg, trace); ha_alert("Lua init: %s: '%s' from %s\n", kind, msg, trace);
@ -12928,8 +12925,7 @@ int hlua_post_init_state(lua_State *L)
case LUA_ERRMEM: case LUA_ERRMEM:
if (!kind) if (!kind)
kind = "out of memory error"; kind = "out of memory error";
lua_settop(L, 0); lua_settop(L, 0); /* Empty the stack. */
lua_pop(L, 1);
trace = hlua_traceback(L, ", "); trace = hlua_traceback(L, ", ");
ha_alert("Lua init: %s: %s\n", kind, trace); ha_alert("Lua init: %s: %s\n", kind, trace);
return_status = 0; return_status = 0;