Skip to content

Memory limit + untrusted user input can lead to abort on Luau #488

Closed
@cheesycod

Description

@cheesycod

Code:

function a(n)
    return a(n)
end

a(19283)

Rust-side code:

    let lua = Lua::new_with(
        LuaStdLib::ALL_SAFE,
        LuaOptions::new().catch_rust_panics(true),
    )?;

    let compiler = mlua::Compiler::new()
        .set_optimization_level(2)
        .set_type_info_level(1);
    lua.set_compiler(compiler.clone());

    lua.sandbox(true)?; // We explicitly want globals to be shared across all scripts in this VM
    lua.set_memory_limit(MAX_TEMPLATE_MEMORY_USAGE)?;


   // After a ton of boiler plate code...
                                    let v: LuaValue = match tis_ref
                                        .lua
                                        .load(&template_bytecode)
                                        .set_name(&exec_name)
                                        .set_mode(mlua::ChunkMode::Binary) // Ensure auto-detection never selects binary mode
                                        .call_async((event, token.clone()))
                                        .await
                                    {
                                        Ok(f) => f,
                                        Err(e) => {
                                            let _ = callback.send(LuaVmResult::LuaError {
                                                err: e,
                                            });
        
                                            while let Err(e) = state::remove_template(&tis_ref.lua, &token) {
                                                log::error!("Could not remove template: {}. Trying again in 1 second", e);
                                                tokio::time::sleep(std::time::Duration::from_secs(1)).await;
                                            };
        
                                            return;
                                        }
                                    };

Leads to the following error:

Nov 26 00:22:22 Hepatitis rust.bot[2027332]: (templating::lang_lua::event) INFO - Event: Serializing data
Nov 26 00:22:22 Hepatitis rust.bot[2027332]: (silverpelt::ar_event) ERROR - Error in dispatch_event_to_modules: memory error: <nil>
Nov 26 00:22:22 Hepatitis rust.bot[2027332]: (rust_bot) ERROR - Error dispatching event to modules: memory error: <nil>
Nov 26 00:22:23 Hepatitis rust.bot[2027332]: fatal runtime error: Rust cannot catch foreign exceptions
Nov 26 00:22:23 Hepatitis rust.bot[2027332]: (silverpelt::ar_event) ERROR - Error in dispatch_event_to_modules: Could not receive data from Lua thread
Nov 26 00:22:23 Hepatitis rust.bot[2027332]: (rust_bot) ERROR - Error dispatching event to modules: Could not receive data from Lua thread

<PROCESS RESTARTS HERE>

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions