Browse Source
[Fix] More lua_settop fixes in MIME processing
Fix additional lua_settop(L, 0) calls in rspamd_message_from_data
and rspamd_mime_expr_process that could corrupt the Lua stack.
pull/5414/merge
Vsevolod Stakhov
7 months ago
No known key found for this signature in database
GPG Key ID: 7647B6790081437
2 changed files with
6 additions and
4 deletions
-
src/libmime/message.c
-
src/libmime/mime_expressions.c
|
|
|
@ -1173,6 +1173,7 @@ rspamd_message_from_data(struct rspamd_task *task, const unsigned char *start, |
|
|
|
} |
|
|
|
else if (task->cfg && task->cfg->libs_ctx) { |
|
|
|
lua_State *L = task->cfg->lua_state; |
|
|
|
int old_top = lua_gettop(L); |
|
|
|
|
|
|
|
if (task->cfg->mime_parser_cfg && |
|
|
|
rspamd_mime_parser_get_lua_magic_cbref(task->cfg->mime_parser_cfg) != -1) { |
|
|
|
@ -1202,7 +1203,7 @@ rspamd_message_from_data(struct rspamd_task *task, const unsigned char *start, |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
lua_settop(L, 0); |
|
|
|
lua_settop(L, old_top); |
|
|
|
} |
|
|
|
else if (rspamd_lua_require_function(L, |
|
|
|
"lua_magic", "detect_mime_part")) { |
|
|
|
@ -1232,7 +1233,7 @@ rspamd_message_from_data(struct rspamd_task *task, const unsigned char *start, |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
lua_settop(L, 0); |
|
|
|
lua_settop(L, old_top); |
|
|
|
} |
|
|
|
else { |
|
|
|
msg_err_task("cannot require lua_magic.detect_mime_part"); |
|
|
|
|
|
|
|
@ -1181,9 +1181,10 @@ rspamd_mime_expr_process(void *ud, rspamd_expression_atom_t *atom) |
|
|
|
} |
|
|
|
} |
|
|
|
else if (mime_atom->type == MIME_ATOM_LOCAL_LUA_FUNCTION) { |
|
|
|
int err_idx; |
|
|
|
int err_idx, old_top; |
|
|
|
|
|
|
|
L = task->cfg->lua_state; |
|
|
|
old_top = lua_gettop(L); |
|
|
|
lua_pushcfunction(L, &rspamd_lua_traceback); |
|
|
|
err_idx = lua_gettop(L); |
|
|
|
|
|
|
|
@ -1208,7 +1209,7 @@ rspamd_mime_expr_process(void *ud, rspamd_expression_atom_t *atom) |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
lua_settop(L, 0); |
|
|
|
lua_settop(L, old_top); |
|
|
|
} |
|
|
|
else { |
|
|
|
ret = rspamd_mime_expr_process_function(mime_atom->d.func, task, |
|
|
|
|