From: David Carlier <devnexen@gmail.com>
Date: Wed, 27 Apr 2016 15:14:50 +0000 (+0100)
Subject: BUG/MEDIUM: lua: protects the upper boundary of the argument list for converters... 
X-Git-Tag: v1.7-dev3~18
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=abdb00fbc012d3291a985d12df361f3df34a3300;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: lua: protects the upper boundary of the argument list for converters/fetches.

When a converter or sample is called from within a Lua code, there is a risk
of invalid argument string data usage when the upper boundary is reached.
Would be kind to port to 1.6 if possible.
---

diff --git a/src/hlua.c b/src/hlua.c
index 4132ace7da..221a7811b2 100644
--- a/src/hlua.c
+++ b/src/hlua.c
@@ -2954,6 +2954,7 @@ __LJMP static int hlua_run_sample_fetch(lua_State *L)
 		hlua_lua2arg(L, i + 2, &args[i]);
 	}
 	args[i].type = ARGT_STOP;
+	args[i].data.str.str = NULL;
 
 	/* Check arguments. */
 	MAY_LJMP(hlua_lua2arg_check(L, 2, args, f->arg_mask, hsmp->p));
@@ -3059,6 +3060,7 @@ __LJMP static int hlua_run_sample_conv(lua_State *L)
 		hlua_lua2arg(L, i + 3, &args[i]);
 	}
 	args[i].type = ARGT_STOP;
+	args[i].data.str.str = NULL;
 
 	/* Check arguments. */
 	MAY_LJMP(hlua_lua2arg_check(L, 3, args, conv->arg_mask, hsmp->p));