Skip to content

Commit

Permalink
Fix theoretical array overflow in lua_typename()
Browse files Browse the repository at this point in the history
Out of the 12 defects in lua that coverity reports, 5 of them involve
`lua_typename()` and out of the dozens of defects in ZFS that lua
reports, 3 of them involve `lua_typename()` due to the ZCP code. Given
all of the uses of `lua_typename()` in the ZCP code, I was surprised
that there were not more. It appears that only 2 were reported because
only 3 called `lua_type()`, which does a defective sanity check that
allows invalid types to be passed.

lua/lua@d4fb848 addressed this in
upstream lua 5.3. Unfortunately, we did not get that fix since we use
lua 5.2 and we do not have assertions enabled in lua, so the upstream
solution would not do anything.

While we could adopt the upstream solution and enable assertions, a
simpler solution is to fix the issue by making `lua_typename()` return
`internal_type_error` whenever it is called with an invalid type. This
avoids the array overflow and if we ever see it appear somewhere, we
will know there is a problem with the lua interpreter.

Reviewed-by: Brian Behlendorf <[email protected]>
Signed-off-by: Richard Yao <[email protected]>
Closes openzfs#13947
  • Loading branch information
ryao authored and tonyhutter committed Nov 22, 2022
1 parent ab5e9f5 commit 7d833b7
Showing 1 changed file with 2 additions and 0 deletions.
2 changes: 2 additions & 0 deletions module/lua/lapi.c
Original file line number Diff line number Diff line change
Expand Up @@ -251,6 +251,8 @@ LUA_API int lua_type (lua_State *L, int idx) {

LUA_API const char *lua_typename (lua_State *L, int t) {
UNUSED(L);
if (t > 8 || t < 0)
return "internal_type_error";
return ttypename(t);
}

Expand Down

0 comments on commit 7d833b7

Please sign in to comment.