• meir@redislabs.com's avatar
    Fix invalid memory write on lua stack overflow {CVE-2021-32626} · a4b813d8
    meir@redislabs.com authored
    When LUA call our C code, by default, the LUA stack has room for 20
    elements. In most cases, this is more than enough but sometimes it's not
    and the caller must verify the LUA stack size before he pushes elements.
    
    On 3 places in the code, there was no verification of the LUA stack size.
    On specific inputs this missing verification could have lead to invalid
    memory write:
    1. On 'luaReplyToRedisReply', one might return a nested reply that will
       explode the LUA stack.
    2. On 'redisProtocolToLuaType', the Redis reply might be deep enough
       to explode the LUA stack (notice that currently there is no such
       command in Redis that returns such a nested reply, but modules might
       do it)
    3. On 'ldbRedis', one might give a command with enough arguments to
       explode the LUA stack (all the arguments will be pushed to the LUA
       stack)
    
    This commit is solving all those 3 issues by calling 'lua_checkstack' and
    verify that there is enough room in the LUA stack to push elements. In
    case 'lua_checkstack' returns an error (there is not enough room in the
    LUA stack and it's not possible to increase the stack), we will do the
    following:
    1. On 'luaReplyToRedisReply', we will return an error to the user.
    2. On 'redisProtocolToLuaType' we will exit with panic (we assume this
       scenario is rare because it can only happen with a module).
    3. On 'ldbRedis', we return an error.
    
    (cherry picked from commit d32a3f74f2a343846b50920e95754a955c1a10a9)
    a4b813d8
scripting.c 90.1 KB