]> git.ipfire.org Git - thirdparty/rspamd.git/commitdiff
Fix bad lua stack leak caused by returning numbers from SA plugin
authorVsevolod Stakhov <vsevolod@highsecure.ru>
Mon, 8 Feb 2016 11:09:22 +0000 (11:09 +0000)
committerVsevolod Stakhov <vsevolod@highsecure.ru>
Mon, 8 Feb 2016 11:09:22 +0000 (11:09 +0000)
src/lua/lua_config.c

index 81595989831c1f02ee2ad61c5af4bad139d030d3..bd1f5852fd7c87d195aadbdb070296975dfff7b7 100644 (file)
@@ -940,36 +940,44 @@ lua_metric_symbol_callback (struct rspamd_task *task, gpointer ud)
 
                if (nresults >= 1) {
                        /* Function returned boolean, so maybe we need to insert result? */
-                       gboolean res;
+                       gint res;
                        GList *opts = NULL;
                        gint i;
                        gdouble flag = 1.0;
 
                        if (lua_type (cd->L, level + 1) == LUA_TBOOLEAN) {
                                res = lua_toboolean (L, level + 1);
-                               if (res) {
-                                       gint first_opt = 2;
+                       }
+                       else {
+                               res = lua_tonumber (L, level + 1);
+                       }
 
-                                       if (lua_type (L, level + 2) == LUA_TNUMBER) {
-                                               flag = lua_tonumber (L, level + 2);
-                                               /* Shift opt index */
-                                               first_opt = 3;
-                                       }
+                       if (res) {
+                               gint first_opt = 2;
 
-                                       for (i = lua_gettop (L); i >= level + first_opt; i--) {
-                                               if (lua_type (L, i) == LUA_TSTRING) {
-                                                       const char *opt = lua_tostring (L, i);
+                               if (lua_type (L, level + 2) == LUA_TNUMBER) {
+                                       flag = lua_tonumber (L, level + 2);
+                                       /* Shift opt index */
+                                       first_opt = 3;
+                               }
+                               else {
+                                       flag = res;
+                               }
 
-                                                       opts = g_list_prepend (opts,
-                                                                       rspamd_mempool_strdup (task->task_pool,
-                                                                                       opt));
-                                               }
+                               for (i = lua_gettop (L); i >= level + first_opt; i--) {
+                                       if (lua_type (L, i) == LUA_TSTRING) {
+                                               const char *opt = lua_tostring (L, i);
+
+                                               opts = g_list_prepend (opts,
+                                                               rspamd_mempool_strdup (task->task_pool,
+                                                                               opt));
                                        }
-                                       rspamd_task_insert_result (task, cd->symbol, flag, opts);
                                }
 
-                               lua_pop (L, nresults);
+                               rspamd_task_insert_result (task, cd->symbol, flag, opts);
                        }
+
+                       lua_pop (L, nresults);
                }
        }