Skip to content

Commit 076aa9c

Browse files
committed
lua: don't attempt to garbage collect a null value
When not sandboxed, a script can get access to the metatable and call `.__gc` with an invalid value like nil, causing a NULL pointer dereference in Suricata. Ticket: OISF#8248
1 parent b944e3b commit 076aa9c

3 files changed

Lines changed: 12 additions & 6 deletions

File tree

src/util-lua-dataset.c

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,8 +42,10 @@ static int LuaDatasetGC(lua_State *luastate)
4242
{
4343
SCLogDebug("gc:start");
4444
struct LuaDataset *s = (struct LuaDataset *)lua_touserdata(luastate, 1);
45-
SCLogDebug("deref %s", s->set->name);
46-
s->set = NULL;
45+
if (s != NULL) {
46+
SCLogDebug("deref %s", s->set->name);
47+
s->set = NULL;
48+
}
4749
SCLogDebug("gc:done");
4850
return 0;
4951
}

src/util-lua-flowlib.c

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,8 +45,10 @@ static int LuaFlowGC(lua_State *luastate)
4545
{
4646
SCLogDebug("gc:start");
4747
struct LuaFlow *s = (struct LuaFlow *)lua_touserdata(luastate, 1);
48-
SCLogDebug("flow %p", s->f);
49-
s->f = NULL;
48+
if (s != NULL) {
49+
SCLogDebug("flow %p", s->f);
50+
s->f = NULL;
51+
}
5052
SCLogDebug("gc:done");
5153
return 0;
5254
}

src/util-lua-packetlib.c

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,8 +45,10 @@ static int LuaPacketGC(lua_State *luastate)
4545
{
4646
SCLogDebug("gc:start");
4747
struct LuaPacket *s = (struct LuaPacket *)lua_touserdata(luastate, 1);
48-
SCLogDebug("packet %p", s->p);
49-
s->p = NULL;
48+
if (s != NULL) {
49+
SCLogDebug("packet %p", s->p);
50+
s->p = NULL;
51+
}
5052
SCLogDebug("gc:done");
5153
return 0;
5254
}

0 commit comments

Comments
 (0)