1. 10 Jul, 2023 1 commit
  2. 28 Nov, 2021 1 commit
    • Meir Shpilraien (Spielrein)'s avatar
      Fix Lua C API violation on lua msgpack lib. (#9832) · a8c1253b
      Meir Shpilraien (Spielrein) authored
      msgpack lib missed using lua_checkstack and so on rare
      cases overflow the stack by at most 2 elements. This is a
      violation of the Lua C API. Notice that Lua allocates
      additional 5 more elements on top of lua->stack_last
      so Redis does not access an invalid memory. But it is an
      API violation and we should avoid it.
      
      This PR also added a new Lua compilation option. The new
      option can be enable using environment variable called
      LUA_DEBUG. If set to `yes` (by default `no`), Lua will be
      compiled without optimizations and with debug symbols (`-O0 -g`).
      In addition, in this new mode, Lua will be compiled with the
      `-DLUA_USE_APICHECK` flag that enables extended Lua C API
      validations.
      
      In addition, set LUA_DEBUG=yes on daily valgrind flow so we
      will be able to catch Lua C API violations in the future.
      a8c1253b
  3. 13 Jun, 2018 2 commits
    • antirez's avatar
      Security: more cmsgpack fixes by @soloestoy. · 5ccb6f7a
      antirez authored
      @soloestoy sent me this additional fixes, after searching for similar
      problems to the one reported in mp_pack(). I'm committing the changes
      because it was not possible during to make a public PR to protect Redis
      users and give Redis providers some time to patch their systems.
      5ccb6f7a
    • antirez's avatar
      Security: fix Lua cmsgpack library stack overflow. · 52a00201
      antirez authored
      During an auditing effort, the Apple Vulnerability Research team discovered
      a critical Redis security issue affecting the Lua scripting part of Redis.
      
      -- Description of the problem
      
      Several years ago I merged a pull request including many small changes at
      the Lua MsgPack library (that originally I authored myself). The Pull
      Request entered Redis in commit 90b6337c, in 2014.
      Unfortunately one of the changes included a variadic Lua function that
      lacked the check for the available Lua C stack. As a result, calling the
      "pack" MsgPack library function with a large number of arguments, results
      into pushing into the Lua C stack a number of new values proportional to
      the number of arguments the function was called with. The pushed values,
      moreover, are controlled by untrusted user input.
      
      This in turn causes stack smashing which we believe to be exploitable,
      while not very deterministic, but it is likely that an exploit could be
      created targeting specific versions of Redis executables. However at its
      minimum the issue results in a DoS, crashing the Redis server.
      
      -- Versions affected
      
      Versions greater or equal to Redis 2.8.18 are affected.
      
      -- Reproducing
      
      Reproduce with this (based on the original reproduction script by
      Apple security team):
      
      https://gist.github.com/antirez/82445fcbea6d9b19f97014cc6cc79f8a
      
      -- Verification of the fix
      
      The fix was tested in the following way:
      
      1) I checked that the problem is no longer observable running the trigger.
      2) The Lua code was analyzed to understand the stack semantics, and that
      actually enough stack is allocated in all the cases of mp_pack() calls.
      3) The mp_pack() function was modified in order to show exactly what items
      in the stack were being set, to make sure that there is no silent overflow
      even after the fix.
      
      -- Credits
      
      Thank you to the Apple team and to the other persons that helped me
      checking the patch and coordinating this communication.
      52a00201
  4. 10 Feb, 2016 1 commit
  5. 07 Feb, 2016 1 commit
  6. 03 Jun, 2015 1 commit
  7. 12 Dec, 2014 1 commit
  8. 05 Dec, 2014 1 commit
  9. 24 Nov, 2014 1 commit
  10. 14 Nov, 2014 1 commit
    • Matt Stancliff's avatar
      Lua: upgrade cmsgpack to 0.4.0 · 90b6337c
      Matt Stancliff authored
      Main reasons for upgrade:
        - Remove a warning when building Redis
        - Add multi pack/unpack
        - Improve memory usage and use Lua allocator properly
        - Fix some edge case encoding/decoding bugs
      90b6337c
  11. 27 Aug, 2013 1 commit
  12. 24 Feb, 2012 1 commit