Skip to content

Commit

Permalink
Fix possible C stack overflow with xml.encode
Browse files Browse the repository at this point in the history
  • Loading branch information
Sainan authored and well-in-that-case committed Jan 22, 2025
1 parent 294081f commit 1d46d41
Show file tree
Hide file tree
Showing 2 changed files with 17 additions and 1 deletion.
5 changes: 4 additions & 1 deletion src/lxml.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@

#define LUA_LIB
#include "lualib.h"
#include "lstate.h" // luaE_incCstack

#include "vendor/Soup/soup/xml.hpp"

Expand All @@ -10,9 +11,10 @@ static soup::UniquePtr<soup::XmlNode> check_xml (lua_State *L, int i) {
if (type == LUA_TTABLE) {
lua_checkstack(L, 3);
lua_pushvalue(L, i);
auto tag = soup::make_unique<soup::XmlTag>();
lua_pushliteral(L, "tag");
if (lua_rawget(L, -2) == LUA_TSTRING) {
luaE_incCstack(L);
auto tag = soup::make_unique<soup::XmlTag>();
tag->name = pluto_checkstring(L, -1);
lua_pop(L, 1); /* pop result of lua_rawget */
lua_pushliteral(L, "attributes");
Expand All @@ -39,6 +41,7 @@ static soup::UniquePtr<soup::XmlNode> check_xml (lua_State *L, int i) {
lua_pop(L, 1); /* pop result of lua_rawget */
}
lua_pop(L, 1); /* pop table from lua_pushvalue */
L->nCcalls--;
return tag;
}
}
Expand Down
13 changes: 13 additions & 0 deletions testes/pluto/basic.pluto
Original file line number Diff line number Diff line change
Expand Up @@ -1640,6 +1640,19 @@ do
}
} == [[<root><entry type="primary">Text node</entry><entry></entry></root>]])
end
do
-- No C Stack overflow on xml.encode either please
local root = { tag = "root", children = {} }
do
local prev_t = root
for i = 1, 1000 do
local t = { tag = "node", children = {} }
prev_t.children:insert(t)
prev_t = t
end
end
assert(select(2, pcall(|| -> require"xml".encode(root))) == "C stack overflow")
end
do
local t = { key = "value" }
table.insert(t, 0)
Expand Down

0 comments on commit 1d46d41

Please sign in to comment.