BUG/MINOR: hlua: unsafe hlua_lua2smp() usage
Fixing hlua_lua2smp() usage in hlua's code since it was assumed that
hlua_lua2smp() makes a standalone smp out of lua data, but it is not
the case.
This is especially true when dealing with lua strings (string is
extracted using lua_tolstring() which returns a pointer to lua string
memory location that may be reclaimed by lua at any time when no longer
used from lua's point of view). Thus, smp generated by hlua_lua2smp() may
only be used from the lua context where the call was initially made, else
it should be explicitly duplicated before exporting it out of lua's
context to ensure safe (standalone) usage.
This should be backported to all stable versions.
(cherry picked from commit 1c07da4b48f680f0de871b2a87a21c1dd05a1ed9)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
(cherry picked from commit 892d554bdbd2aa13db74f1b376ffb6679ffca41f)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
(cherry picked from commit 16056fa6720f6c058313118f18d8be48e625ef77)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
diff --git a/src/hlua.c b/src/hlua.c
index d871de5..af64a02 100644
--- a/src/hlua.c
+++ b/src/hlua.c
@@ -3770,7 +3770,9 @@
memset(&smp, 0, sizeof(smp));
hlua_lua2smp(L, 3, &smp);
- /* Store the sample in a variable. */
+ /* Store the sample in a variable. We don't need to dup the smp, vars API
+ * already takes care of duplicating dynamic var data.
+ */
smp_set_owner(&smp, s->be, s->sess, s, 0);
if (lua_gettop(L) == 4 && lua_toboolean(L, 4))
@@ -4255,7 +4257,9 @@
memset(&smp, 0, sizeof(smp));
hlua_lua2smp(L, 3, &smp);
- /* Store the sample in a variable. */
+ /* Store the sample in a variable. We don't need to dup the smp, vars API
+ * already takes care of duplicating dynamic var data.
+ */
smp_set_owner(&smp, s->be, s->sess, s, 0);
if (lua_gettop(L) == 4 && lua_toboolean(L, 4))
@@ -5350,7 +5354,9 @@
memset(&smp, 0, sizeof(smp));
hlua_lua2smp(L, 3, &smp);
- /* Store the sample in a variable. */
+ /* Store the sample in a variable. We don't need to dup the smp, vars API
+ * already takes care of duplicating dynamic var data.
+ */
smp_set_owner(&smp, htxn->p, htxn->s->sess, htxn->s, htxn->dir & SMP_OPT_DIR);
if (lua_gettop(L) == 4 && lua_toboolean(L, 4))
@@ -6553,6 +6559,10 @@
/* Convert the returned value in sample. */
hlua_lua2smp(stream->hlua->T, -1, smp);
+ /* dup the smp before popping the related lua value and
+ * returning it to haproxy
+ */
+ smp_dup(smp);
lua_pop(stream->hlua->T, 1);
return 1;
@@ -6688,6 +6698,10 @@
/* Convert the returned value in sample. */
hlua_lua2smp(stream->hlua->T, -1, smp);
+ /* dup the smp before popping the related lua value and
+ * returning it to haproxy
+ */
+ smp_dup(smp);
lua_pop(stream->hlua->T, 1);
/* Set the end of execution flag. */