tarantool / luajit / 11349070901

70%

tarantool/master: 93%

Build Type

push

github

Committed by Buristan

Commit Message

FFI: Fix __tostring metamethod access to enum cdata value.

Thanks to Sergey Kaplun.

(cherry picked from commit f2a1cd432)

On a 64-bit host, `*(uint32_t **)p` (in the
`lj_cf_ffi_meta___tostring()`) is the read of 8 bytes, while the size of
the cdata tail for the enum is only 4. This leads to heap-buffer-overflow
during the call of `tostring()` on the corresponding cdata.

This patch fixes the pointer cast to `(uint32_t *)p`, which is correct.

Sergey Kaplun:
* added the description and the test for the problem

Part of tarantool/tarantool#10199

Reviewed-by: Sergey Bronnikov <sergeyb@tarantool.org>
Reviewed-by: Maxim Kokryashkin <m.kokryashkin@tarantool.org>
Signed-off-by: Sergey Kaplun <skaplun@tarantool.org>
(cherry picked from commit ce35307bc)

Run Details

5670 of 6008 branches covered (94.37%)

Branch coverage included in aggregate %.

1 of 1 new or added line in 1 file covered. (100.0%)

9 existing lines in 3 files now uncovered.

21590 of 23343 relevant lines covered (92.49%)

892637.11 hits per line