konevsa/haproxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

BUG/MEDIUM: lua: fix argument handling in data removal functions

Browse Source 
Lua API Channel.remove() and HTTPMessage.remove() expects 1 to 3
arguments (counting the manipulated object), with offset and length
being the 2nd and 3rd argument, respectively.

hlua_{channel,http_msg}_del_data() incorrectly gets the 3rd argument as
offset, and 4th (nonexistent) as length. hlua_http_msg_del_data() also
improperly checks arguments. This patch fixes argument handling in both.

Must be backported to 2.5.
This commit is contained in:
Boyang Li 2022-05-10 17:47:23 +00:00 committed by Christopher Faulet
parent eeeeed44ea
commit e0c5435d76
1 changed files with 9 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
src/hlua.c
View File

@ -3714,8 +3714,8 @@ __LJMP static int hlua_channel_del_data(lua_State *L)
WILL_LJMP(lua_error(L));
offset = output;
if (lua_gettop(L) > 2) {
offset = MAY_LJMP(luaL_checkinteger(L, 3));
if (lua_gettop(L) > 1) {
offset = MAY_LJMP(luaL_checkinteger(L, 2));
if (offset < 0)
offset = MAX(0, (int)input + offset);
offset += output;
@ -3726,8 +3726,8 @@ __LJMP static int hlua_channel_del_data(lua_State *L)
}
len = output + input - offset;
if (lua_gettop(L) == 4) {
len = MAY_LJMP(luaL_checkinteger(L, 4));
if (lua_gettop(L) == 3) {
len = MAY_LJMP(luaL_checkinteger(L, 3));
if (!len)
goto end;
if (len == -1)
@ -6704,8 +6704,7 @@ __LJMP static int hlua_http_msg_del_data(lua_State *L)
int offset, len;
if (lua_gettop(L) < 1 || lua_gettop(L) > 3)
WILL_LJMP(luaL_error(L, "'insert' expects at most 2 arguments"));
MAY_LJMP(check_args(L, 2, "insert"));
WILL_LJMP(luaL_error(L, "'remove' expects at most 2 arguments"));
msg = MAY_LJMP(hlua_checkhttpmsg(L, 1));
if (msg->msg_state < HTTP_MSG_DATA)
@ -6716,8 +6715,8 @@ __LJMP static int hlua_http_msg_del_data(lua_State *L)
WILL_LJMP(lua_error(L));
offset = input + output;
if (lua_gettop(L) > 2) {
offset = MAY_LJMP(luaL_checkinteger(L, 3));
if (lua_gettop(L) > 1) {
offset = MAY_LJMP(luaL_checkinteger(L, 2));
if (offset < 0)
offset = MAX(0, (int)input + offset);
offset += output;
@ -6728,8 +6727,8 @@ __LJMP static int hlua_http_msg_del_data(lua_State *L)
}
len = output + input - offset;
if (lua_gettop(L) == 4) {
len = MAY_LJMP(luaL_checkinteger(L, 4));
if (lua_gettop(L) == 3) {
len = MAY_LJMP(luaL_checkinteger(L, 3));
if (!len)
goto end;
if (len == -1)