• Meir Shpilraien (Spielrein)'s avatar
    Fix invalid memory write on lua stack overflow (CVE-2021-32626) (#9591) · 0f8b634c
    Meir Shpilraien (Spielrein) authored
    When LUA call our C code, by default, the LUA stack has room for 10
    elements. In most cases, this is more than enough but sometimes it's not
    and the caller must verify the LUA stack size before he pushes elements.
    
    On 3 places in the code, there was no verification of the LUA stack size.
    On specific inputs this missing verification could have lead to invalid
    memory write:
    1. On 'luaReplyToRedisReply', one might return a nested reply that will
       explode the LUA stack.
    2. On 'redisProtocolToLuaType', the Redis reply might be deep enough
       to explode the LUA stack (notice that currently there is no such
       command in Redis that returns such a nested reply, but modules might
       do it)
    3. On 'ldbRedis', one might give a command with enough arguments to
       explode the LUA stack (all the arguments will be pushed to the LUA
       stack)
    
    This commit is solving all those 3 issues by calling 'lua_checkstack' and
    verify that there is enough room in the LUA stack to push elements. In
    case 'lua_checkstack' returns an error (there is not enough room in the
    LUA stack and it's not possible to increase the stack), we will do the
    following:
    1. On 'luaReplyToRedisReply', we will return an error to the user.
    2. On 'redisProtocolToLuaType' we will exit with panic (we assume this
       scenario is rare because it can only happen with a module).
    3. On 'ldbRedis', we return an error.
    0f8b634c
scripting.tcl 38.7 KB