Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Integer overflow (leading to stack-based buffer overflow) in embedded lua_struct.c #3626

Open
Crispy-fried-chicken opened this issue Feb 3, 2024 · 3 comments
Open

Integer overflow (leading to stack-based buffer overflow) in embedded lua_struct.c #3626

Crispy-fried-chicken opened this issue Feb 3, 2024 · 3 comments

Comments

@Crispy-fried-chicken
Copy link
Contributor

getnum in app/modules/struct.c potentially has an integer overflow if fmt is set too large. It might be triggered by running such lua statement: EVAL "struct.pack('>I2147483648', '10')" 0 It can be easily avoid by adding a bound check in getnum, and I'd like to open a PR for that if necessary.
@pjsg
Copy link
Member

pjsg commented Feb 4, 2024

Please open a PR for that.

@Crispy-fried-chicken Crispy-fried-chicken mentioned this issue Feb 5, 2024
Merged
@Crispy-fried-chicken
Copy link
Contributor Author

Please open a PR for that.

Sure, I've already opened, which is #3633 please check it, thank you!

@Crispy-fried-chicken Crispy-fried-chicken mentioned this issue Feb 5, 2024
Merged
@Crispy-fried-chicken
Copy link
Contributor Author

CVE-2024-36671 is assigned for this issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@pjsg @Crispy-fried-chicken