Skip to content

{184399398}: fix lua stackoverflow on temp table#5982

Open
emelialei88 wants to merge 1 commit into
bloomberg:mainfrom
emelialei88:fix/lua-sec2
Open

{184399398}: fix lua stackoverflow on temp table#5982
emelialei88 wants to merge 1 commit into
bloomberg:mainfrom
emelialei88:fix/lua-sec2

Conversation

@emelialei88
Copy link
Copy Markdown
Contributor

Problem

create_temp_table in lua/sp.c used alloca to allocate the DDL string on the stack, sized by the user-supplied column type string. A malicious or buggy SP passing a huge type (e.g. string.rep('TEXT ', 2000000)) into db:table() would blow the stack and crash the DB.

Changes

  • lua/sp.c: validate column name/type from the Lua table — reject NULL or oversized values (name > MAXTABLELEN, type > 64). Replace alloca(len) with malloc(len) so large DDLs go to the heap, with matching free() on all exit paths.
  • tests/sp.test/t21.req / t21.req.out: new regression test (ddlbomb) that constructs a 10MB type string and confirms the SP fails cleanly with bad column name or type in 'table' instead of crashing.

Notes

The comment about lua_prepare_sql_with_temp_ddl potentially longjmp-ing and leaking ddl is preserved — the leak is bounded and exceptional, same trade-off as before.

Copy link
Copy Markdown

@roborivers roborivers left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cbuild submission: Success ✓.
Regression testing: Success ✓.

The first 10 failing tests are:
sc_resume_logicalsc_generated **quarantined**
noresetgen
consumer_non_atomic_default_consumer_generated **quarantined**
reco-ddlk-sql [timeout] **quarantined**

Signed-off-by: Emelia Lei <wlei29@bloomberg.net>
@emelialei88 emelialei88 marked this pull request as ready for review May 29, 2026 15:50
Copy link
Copy Markdown

@roborivers roborivers left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cbuild submission: Success ✓.
Regression testing: Success ✓.

The first 10 failing tests are:
sc_timepart **quarantined**
consumer_non_atomic_default_consumer_generated **quarantined**
remotecreate_twopc_generated
remotecreate
reco-ddlk-sql [timeout] **quarantined**

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants