From: Aurelien DARRAGON <adarragon@haproxy.com>
Date: Wed, 28 Sep 2022 14:03:45 +0000 (+0200)
Subject: BUG/MINOR: hlua: fixing hlua_http_msg_insert_data behavior
X-Git-Tag: v2.7-dev7~22
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7fdba0ae544cb1b14b7d3864b06f38c752505094;p=thirdparty%2Fhaproxy.git

BUG/MINOR: hlua: fixing hlua_http_msg_insert_data behavior

hlua_http_msg_insert_data() function is called upon
HTTPMessage.insert() method from lua script.

This function did not work properly for multiple reasons:

  - An incorrect argument check was performed and prevented the user
  from providing optional offset argument.

  - Input and output variables were inverted
  and offset was not handled properly. The same bug
  was also fixed in hlua_http_msg_del_data(), see:
  'BUG/MINOR: hlua: fixing hlua_http_msg_del_data behavior'

The function now behaves as described in the documentation.

This could be backported to 2.6 and 2.5.
---

diff --git a/src/hlua.c b/src/hlua.c
index 253d334c9c..5afe7dbe18 100644
--- a/src/hlua.c
+++ b/src/hlua.c
@@ -6676,24 +6676,23 @@ __LJMP static int hlua_http_msg_insert_data(lua_State *L)
 
 	if (lua_gettop(L) < 2 || lua_gettop(L) > 3)
 		WILL_LJMP(luaL_error(L, "'insert' expects at least 1 argument and at most 2 arguments"));
-	MAY_LJMP(check_args(L, 2, "insert"));
 	msg = MAY_LJMP(hlua_checkhttpmsg(L, 1));
 
 	if (msg->msg_state < HTTP_MSG_DATA)
 		WILL_LJMP(lua_error(L));
 
 	str = MAY_LJMP(luaL_checklstring(L, 2, &sz));
-	filter = hlua_http_msg_filter(L, 1, msg, &input, &output);
+	filter = hlua_http_msg_filter(L, 1, msg, &output, &input);
 	if (!filter || !hlua_filter_from_payload(filter))
 		WILL_LJMP(lua_error(L));
 
-	offset = input + output;
+	offset = output;
 	if (lua_gettop(L) > 2) {
 		offset = MAY_LJMP(luaL_checkinteger(L, 3));
 		if (offset < 0)
 			offset = MAX(0, (int)input + offset);
 		offset += output;
-		if (offset < output || offset > output + input) {
+		if (offset > output + input) {
 			lua_pushfstring(L, "offset out of range.");
 			WILL_LJMP(lua_error(L));
 		}