Lua cmsgpack lib updated to latest version.

It fixes a bad bug that crashes the server in certain conditions
as shown in issue #2210.
This commit is contained in:
antirez 2014-12-12 22:56:33 +01:00
parent bbf0736c4e
commit 66e2bdf210

View File

@ -31,12 +31,10 @@
#define BITS_32 0 #define BITS_32 0
#endif #endif
#if LUA_VERSION_NUM < 503 #if BITS_32
#if BITS_32 #define lua_pushunsigned(L, n) lua_pushnumber(L, n)
#define lua_pushunsigned(L, n) lua_pushnumber(L, n) #else
#else #define lua_pushunsigned(L, n) lua_pushinteger(L, n)
#define lua_pushunsigned(L, n) lua_pushinteger(L, n)
#endif
#endif #endif
/* ============================================================================= /* =============================================================================
@ -256,7 +254,7 @@ static void mp_encode_int(mp_buf *buf, int64_t n) {
} }
} else { } else {
if (n >= -32) { if (n >= -32) {
b[0] = ((char)n); /* negative fixnum */ b[0] = ((signed char)n); /* negative fixnum */
enclen = 1; enclen = 1;
} else if (n >= -128) { } else if (n >= -128) {
b[0] = 0xd0; /* int 8 */ b[0] = 0xd0; /* int 8 */
@ -544,6 +542,7 @@ static int mp_pack(lua_State *L) {
void mp_decode_to_lua_type(lua_State *L, mp_cur *c); void mp_decode_to_lua_type(lua_State *L, mp_cur *c);
void mp_decode_to_lua_array(lua_State *L, mp_cur *c, size_t len) { void mp_decode_to_lua_array(lua_State *L, mp_cur *c, size_t len) {
assert(len <= UINT_MAX);
int index = 1; int index = 1;
lua_newtable(L); lua_newtable(L);
@ -556,6 +555,7 @@ void mp_decode_to_lua_array(lua_State *L, mp_cur *c, size_t len) {
} }
void mp_decode_to_lua_hash(lua_State *L, mp_cur *c, size_t len) { void mp_decode_to_lua_hash(lua_State *L, mp_cur *c, size_t len) {
assert(len <= UINT_MAX);
lua_newtable(L); lua_newtable(L);
while(len--) { while(len--) {
mp_decode_to_lua_type(L,c); /* key */ mp_decode_to_lua_type(L,c); /* key */
@ -588,7 +588,7 @@ void mp_decode_to_lua_type(lua_State *L, mp_cur *c) {
break; break;
case 0xd0: /* int 8 */ case 0xd0: /* int 8 */
mp_cur_need(c,2); mp_cur_need(c,2);
lua_pushinteger(L,(char)c->p[1]); lua_pushinteger(L,(signed char)c->p[1]);
mp_cur_consume(c,2); mp_cur_consume(c,2);
break; break;
case 0xcd: /* uint 16 */ case 0xcd: /* uint 16 */
@ -699,13 +699,14 @@ void mp_decode_to_lua_type(lua_State *L, mp_cur *c) {
case 0xdb: /* raw 32 */ case 0xdb: /* raw 32 */
mp_cur_need(c,5); mp_cur_need(c,5);
{ {
size_t l = (c->p[1] << 24) | size_t l = ((size_t)c->p[1] << 24) |
(c->p[2] << 16) | ((size_t)c->p[2] << 16) |
(c->p[3] << 8) | ((size_t)c->p[3] << 8) |
c->p[4]; (size_t)c->p[4];
mp_cur_need(c,5+l); mp_cur_consume(c,5);
lua_pushlstring(L,(char*)c->p+5,l); mp_cur_need(c,l);
mp_cur_consume(c,5+l); lua_pushlstring(L,(char*)c->p,l);
mp_cur_consume(c,l);
} }
break; break;
case 0xdc: /* array 16 */ case 0xdc: /* array 16 */
@ -719,10 +720,10 @@ void mp_decode_to_lua_type(lua_State *L, mp_cur *c) {
case 0xdd: /* array 32 */ case 0xdd: /* array 32 */
mp_cur_need(c,5); mp_cur_need(c,5);
{ {
size_t l = (c->p[1] << 24) | size_t l = ((size_t)c->p[1] << 24) |
(c->p[2] << 16) | ((size_t)c->p[2] << 16) |
(c->p[3] << 8) | ((size_t)c->p[3] << 8) |
c->p[4]; (size_t)c->p[4];
mp_cur_consume(c,5); mp_cur_consume(c,5);
mp_decode_to_lua_array(L,c,l); mp_decode_to_lua_array(L,c,l);
} }
@ -738,10 +739,10 @@ void mp_decode_to_lua_type(lua_State *L, mp_cur *c) {
case 0xdf: /* map 32 */ case 0xdf: /* map 32 */
mp_cur_need(c,5); mp_cur_need(c,5);
{ {
size_t l = (c->p[1] << 24) | size_t l = ((size_t)c->p[1] << 24) |
(c->p[2] << 16) | ((size_t)c->p[2] << 16) |
(c->p[3] << 8) | ((size_t)c->p[3] << 8) |
c->p[4]; (size_t)c->p[4];
mp_cur_consume(c,5); mp_cur_consume(c,5);
mp_decode_to_lua_hash(L,c,l); mp_decode_to_lua_hash(L,c,l);
} }
@ -830,15 +831,15 @@ static int mp_unpack(lua_State *L) {
} }
static int mp_unpack_one(lua_State *L) { static int mp_unpack_one(lua_State *L) {
int offset = luaL_optint(L, 2, 0); int offset = luaL_optinteger(L, 2, 0);
/* Variable pop because offset may not exist */ /* Variable pop because offset may not exist */
lua_pop(L, lua_gettop(L)-1); lua_pop(L, lua_gettop(L)-1);
return mp_unpack_full(L, 1, offset); return mp_unpack_full(L, 1, offset);
} }
static int mp_unpack_limit(lua_State *L) { static int mp_unpack_limit(lua_State *L) {
int limit = luaL_checkint(L, 2); int limit = luaL_checkinteger(L, 2);
int offset = luaL_optint(L, 3, 0); int offset = luaL_optinteger(L, 3, 0);
/* Variable pop because offset may not exist */ /* Variable pop because offset may not exist */
lua_pop(L, lua_gettop(L)-1); lua_pop(L, lua_gettop(L)-1);