From: Vsevolod Stakhov <vsevolod@rspamd.com>
Date: Tue, 23 Dec 2025 11:15:21 +0000 (+0000)
Subject: [Fix] More lua_settop fixes in MIME processing
X-Git-Tag: 3.14.3~30
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b21cc17518a27fbbc14c97cedd04241a72e32387;p=thirdparty%2Frspamd.git

[Fix] More lua_settop fixes in MIME processing

Fix additional lua_settop(L, 0) calls in rspamd_message_from_data
and rspamd_mime_expr_process that could corrupt the Lua stack.
---

diff --git a/src/libmime/message.c b/src/libmime/message.c
index 2bc8fbdedb..0a7a445a18 100644
--- a/src/libmime/message.c
+++ b/src/libmime/message.c
@@ -1173,6 +1173,7 @@ rspamd_message_from_data(struct rspamd_task *task, const unsigned char *start,
 	}
 	else if (task->cfg && task->cfg->libs_ctx) {
 		lua_State *L = task->cfg->lua_state;
+		int old_top = lua_gettop(L);
 
 		if (task->cfg->mime_parser_cfg &&
 			rspamd_mime_parser_get_lua_magic_cbref(task->cfg->mime_parser_cfg) != -1) {
@@ -1202,7 +1203,7 @@ rspamd_message_from_data(struct rspamd_task *task, const unsigned char *start,
 				}
 			}
 
-			lua_settop(L, 0);
+			lua_settop(L, old_top);
 		}
 		else if (rspamd_lua_require_function(L,
 											 "lua_magic", "detect_mime_part")) {
@@ -1232,7 +1233,7 @@ rspamd_message_from_data(struct rspamd_task *task, const unsigned char *start,
 				}
 			}
 
-			lua_settop(L, 0);
+			lua_settop(L, old_top);
 		}
 		else {
 			msg_err_task("cannot require lua_magic.detect_mime_part");
diff --git a/src/libmime/mime_expressions.c b/src/libmime/mime_expressions.c
index f77017ff21..3302a0982d 100644
--- a/src/libmime/mime_expressions.c
+++ b/src/libmime/mime_expressions.c
@@ -1181,9 +1181,10 @@ rspamd_mime_expr_process(void *ud, rspamd_expression_atom_t *atom)
 		}
 	}
 	else if (mime_atom->type == MIME_ATOM_LOCAL_LUA_FUNCTION) {
-		int err_idx;
+		int err_idx, old_top;
 
 		L = task->cfg->lua_state;
+		old_top = lua_gettop(L);
 		lua_pushcfunction(L, &rspamd_lua_traceback);
 		err_idx = lua_gettop(L);
 
@@ -1208,7 +1209,7 @@ rspamd_mime_expr_process(void *ud, rspamd_expression_atom_t *atom)
 			}
 		}
 
-		lua_settop(L, 0);
+		lua_settop(L, old_top);
 	}
 	else {
 		ret = rspamd_mime_expr_process_function(mime_atom->d.func, task,