• Meir Shpilraien (Spielrein)'s avatar
    Clean Lua stack before parsing call reply to avoid crash on a call with many arguments (#9809) · 93c1d31d
    Meir Shpilraien (Spielrein) authored
    This commit 0f8b634c (CVE-2021-32626 released in 6.2.6, 6.0.16, 5.0.14)
    fixes an invalid memory write issue by using `lua_checkstack` API to make
    sure the Lua stack is not overflow. This fix was added on 3 places:
    1. `luaReplyToRedisReply`
    2. `ldbRedis`
    3. `redisProtocolToLuaType`
    
    On the first 2 functions, `lua_checkstack` is handled gracefully while the
    last is handled with an assert and a statement that this situation can
    not happened (only with misbehave module):
    
    > the Redis reply might be deep enough to explode the LUA stack (notice
    that currently there is no such command in Redis that returns such a nested
    reply, but modules might do it)
    
    The issue that was discovered is that user arguments is also considered part
    of the stack, and so the following script (for example) make the assertion reachable:
    ```
    local a = {}
    for i=1,7999 do
        a[i] = 1
    end
    return redis.call("lpush", "l", unpack(a))
    ```
    
    This is a regression because such a script would have worked before and now
    its crashing Redis. The solution is to clear the function arguments from the Lua
    stack which makes the original assumption true and the assertion unreachable.
    
    (cherry picked from commit 6b0b04f1)
    93c1d31d
scripting.c 106 KB