v3: Lua m.setvar() returns -1 on errors, so the script gets stack garbage

未关闭 适合新手
  • 哪里不对？
#3,731 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

@fzipi 已经在做这个了。

开始于 2026年11月1日。

  • #3732 来自 @fzipi —— 未关闭

评估

难度
2/5
预计耗时
1-3 小时
新手友好度
72/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
cpp, lua
领域
backend

调研方向

从 src/engine/lua.cc 中的 Lua::setvar() 开始，这里的三个错误分支都返回 -1（位于第 343、351 和 366 行附近）。与 getvar() 进行比较，后者在任何 C++ 局部变量存在之前就调用了 luaL_checkstring()。完成的标准是：错误分支返回 0（或压入 nil 并返回 1）；两处 luaL_checkstring() 调用移动到 std::string 局部变量之前；修正拼写错误；并且回归测试运行两个复现脚本并检查返回值。

由索引模型根据 Issue 内容生成。

描述

3.x bug

@airween, I found this while reviewing #3730. It's in the same file but a separate problem, so I'm filing it on its own.

Problem

Lua::setvar() (src/engine/lua.cc, v3/master 9d45c6d7) returns -1 on its three error paths:

  • line 343: wrong number of arguments;
  • line 351: luaL_checkstring() returned NULL;
  • line 366: no . in the name, so no collection.

A lua_CFunction must return the number of values it pushed onto the stack. Lua doesn't check for a negative count in release builds, so the call returns whatever happens to be on the stack.

Reproduction

I used two scripts run with exec: in phase 1 (macOS, Lua 5.5.1):

-- nodot.lua
function main()
    local r = m.setvar("novar", "x");
    m.log(4, "after setvar, got: " .. tostring(r));
    return nil;
end

-- onearg.lua
function main()
    local r = m.setvar("tx.a");
    m.log(4, "after setvar, got: " .. tostring(r));
    return nil;
end

Debug log:

[8] m.setvar: Must specify a collection using dot character - ie m.setvar(tx.myvar,mydata)
[4] after setvar, got: userdata: 0x16f5b2498
...
[8] m.setvar: Failed m.setvar funtion must has 2 arguments
[4] after setvar, got: [

In the first case the script gets back the __transaction pointer that setvar() pushed. In the second it gets a stray string. Nothing crashed here, but this is undefined behaviour, and the result depends on the Lua version and build.

A related, smaller point

luaL_checkstring() raises a Lua error, using longjmp with the usual C build of Lua, when an argument isn't a string, e.g. m.setvar("tx.a", {}). In setvar() that happens after the three std::string locals have been constructed, so their destructors are skipped. They're still empty at that point, so nothing leaks today, but it's fragile. getvar(), getvars() and log() call luaL_checkstring() before any C++ object exists, so they're fine.

Suggested fix
  • Return 0 (no results) on the three error paths, as log() does. Or, if a script should see the failure, push nil or false and return 1.
  • Move the two luaL_checkstring() calls before the std::string locals, as in getvar().
  • While there: fix the typo in the debug message ("funtion must has" → "function must have").

A regression case with the two scripts above, checking that m.setvar() returns nil (or false), would cover it.

主要语言
C++
星标
9.8k
派生
1.8k
平均合并
1 天 6 小时
30 天内合并 PR
20

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 有 Pull Request 模板
  • 没有贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

owasp-modsecurity/ModSecurity 的其他 Issue

查看 owasp-modsecurity/ModSecurity 的全部 Issue

相似的 Issue

更多 C++ Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。