BUG/MINOR: lua: Segfaults with wrong usage of types.

Patrick reported that this simple configuration made haproxy segfaults:

    global
        lua-load /tmp/haproxy.lua

    frontend f1
        mode http
        bind :8000
        default_backend b1

        http-request lua.foo

    backend b1
        mode http
        server s1 127.0.0.1:8080

with this '/tmp/haproxy.lua' script:

    core.register_action("foo", { "http-req" }, function(txn)
        txn.sc:ipmask(txn.f:src(), 24, 112)
    end)

This is due to missing initialization of the array of arguments
passed to hlua_lua2arg_check() which makes it enter code with
corrupted arguments.

Thanks a lot to Patrick Hemmer for having reported this issue.

Must be backported to 1.8, 1.7 and 1.6.

diff --git a/src/hlua.c b/src/hlua.c
index 716bd29cd4c3504b9396084a23f0e56d09dd55ca..93ec44c3b7543002263a5abd3b6456d179805b70 100644 (file)
--- a/src/hlua.c
+++ b/src/hlua.c
@@ -3256,7 +3256,7 @@ __LJMP static int hlua_run_sample_fetch(lua_State *L)
 {
        struct hlua_smp *hsmp;
        struct sample_fetch *f;
-       struct arg args[ARGM_NBARGS + 1];
+       struct arg args[ARGM_NBARGS + 1] = {{0}};
        int i;
        struct sample smp;
 
@@ -3370,7 +3370,7 @@ __LJMP static int hlua_run_sample_conv(lua_State *L)
 {
        struct hlua_smp *hsmp;
        struct sample_conv *conv;
-       struct arg args[ARGM_NBARGS + 1];
+       struct arg args[ARGM_NBARGS + 1] = {{0}};
        int i;
        struct sample smp;