Skip to content

Commit 389e455

Browse files
ryaotonyhutter
authored andcommitted
Fix theoretical array overflow in lua_typename()
Out of the 12 defects in lua that coverity reports, 5 of them involve `lua_typename()` and out of the dozens of defects in ZFS that lua reports, 3 of them involve `lua_typename()` due to the ZCP code. Given all of the uses of `lua_typename()` in the ZCP code, I was surprised that there were not more. It appears that only 2 were reported because only 3 called `lua_type()`, which does a defective sanity check that allows invalid types to be passed. lua/lua@d4fb848 addressed this in upstream lua 5.3. Unfortunately, we did not get that fix since we use lua 5.2 and we do not have assertions enabled in lua, so the upstream solution would not do anything. While we could adopt the upstream solution and enable assertions, a simpler solution is to fix the issue by making `lua_typename()` return `internal_type_error` whenever it is called with an invalid type. This avoids the array overflow and if we ever see it appear somewhere, we will know there is a problem with the lua interpreter. Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Signed-off-by: Richard Yao <richard.yao@alumni.stonybrook.edu> Closes openzfs#13947
1 parent 807ae8b commit 389e455

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

module/lua/lapi.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -251,6 +251,8 @@ LUA_API int lua_type (lua_State *L, int idx) {
251251

252252
LUA_API const char *lua_typename (lua_State *L, int t) {
253253
UNUSED(L);
254+
if (t > 8 || t < 0)
255+
return "internal_type_error";
254256
return ttypename(t);
255257
}
256258

0 commit comments

Comments
 (0)