From c1904b4f751ae59d9a48fab651f4a0e6a232375e Mon Sep 17 00:00:00 2001
From: Vsevolod Stakhov <vsevolod@highsecure.ru>
Date: Mon, 27 Mar 2017 17:45:41 +0100
Subject: [PATCH] [Fix] Fix various issues related to Lua stack manipulation

Issue: #841
---
 src/lua/lua_redis.c     | 11 +++++++----
 src/lua/lua_sqlite3.c   |  6 ++++--
 src/rspamadm/rspamadm.c | 17 +++++++----------
 3 files changed, 18 insertions(+), 16 deletions(-)

diff --git a/src/lua/lua_redis.c b/src/lua/lua_redis.c
index c75ca4cfb..623203c6c 100644
--- a/src/lua/lua_redis.c
+++ b/src/lua/lua_redis.c
@@ -480,11 +480,11 @@ lua_redis_parse_args (lua_State *L, gint idx, const gchar *cmd,
 
 		args = g_slice_alloc ((top + 1) * sizeof (gchar *));
 		arglens = g_slice_alloc ((top + 1) * sizeof (gsize));
-		lua_pushnil (L);
 		arglens[0] = strlen (cmd);
 		args[0] = g_slice_alloc (arglens[0]);
 		memcpy (args[0], cmd, arglens[0]);
 		top = 1;
+		lua_pushnil (L);
 
 		while (lua_next (L, -2) != 0) {
 			if (lua_isstring (L, -1)) {
@@ -518,7 +518,6 @@ lua_redis_parse_args (lua_State *L, gint idx, const gchar *cmd,
 
 		args = g_slice_alloc (sizeof (gchar *));
 		arglens = g_slice_alloc (sizeof (gsize));
-		lua_pushnil (L);
 		arglens[0] = strlen (cmd);
 		args[0] = g_slice_alloc (arglens[0]);
 		memcpy (args[0], cmd, arglens[0]);
@@ -1226,7 +1225,7 @@ lua_redis_add_cmd (lua_State *L)
 		}
 	}
 
-	lua_pushboolean (L, 1);
+	lua_pushboolean (L, true);
 
 	return 1;
 }
@@ -1262,6 +1261,10 @@ lua_redis_exec (lua_State *L)
 			return 0;
 		}
 		else {
+			if (!lua_checkstack (L, (ctx->cmds_pending * 2) + 1)) {
+				return luaL_error (L, "cannot resiz stack to fit %d commands",
+					ctx->cmds_pending);
+			}
 			for (i = 0; i < ctx->cmds_pending; i ++) {
 				ret = redisGetReply (ctx->d.sync, (void **)&r);
 
@@ -1273,7 +1276,7 @@ lua_redis_exec (lua_State *L)
 					}
 					else {
 						lua_pushboolean (L, FALSE);
-						lua_pushstring (L, r->str);
+						lua_pushlstring (L, r->str, r->len);
 					}
 					freeReplyObject (r);
 				}
diff --git a/src/lua/lua_sqlite3.c b/src/lua/lua_sqlite3.c
index 97b112ac4..4cb900dd9 100644
--- a/src/lua/lua_sqlite3.c
+++ b/src/lua/lua_sqlite3.c
@@ -266,7 +266,9 @@ lua_sqlite3_next_row (lua_State *L)
 		}
 	}
 
-	return 0;
+	lua_pushnil (L);
+
+	return 1;
 }
 
 /***
@@ -294,7 +296,7 @@ lua_sqlite3_rows (lua_State *L)
 		if (sqlite3_prepare_v2 (db, query, -1, &stmt, NULL) != SQLITE_OK) {
 			msg_err ("cannot prepare query %s: %s", query, sqlite3_errmsg (db));
 			lua_pushstring (L, sqlite3_errmsg (db));
-			lua_error (L);
+			return lua_error (L);
 		}
 		else {
 			top = lua_gettop (L);
diff --git a/src/rspamadm/rspamadm.c b/src/rspamadm/rspamadm.c
index e242ab925..d524a8f61 100644
--- a/src/rspamadm/rspamadm.c
+++ b/src/rspamadm/rspamadm.c
@@ -190,7 +190,7 @@ rspamadm_execute_lua_ucl_subr (gpointer pL, gint argc, gchar **argv,
 		const ucl_object_t *res, const gchar *script)
 {
 	lua_State *L = pL;
-	gint err_idx, cb_idx, i, ret;
+	gint err_idx, i, ret;
 	GString *tb;
 
 	g_assert (script != NULL);
@@ -203,14 +203,13 @@ rspamadm_execute_lua_ucl_subr (gpointer pL, gint argc, gchar **argv,
 		return FALSE;
 	}
 	else {
-		if (lua_type (L, -1) == LUA_TFUNCTION) {
-			cb_idx = luaL_ref (L, LUA_REGISTRYINDEX);
-		}
-		else {
+		if (lua_type (L, -1) != LUA_TFUNCTION) {
 			msg_err ("lua script must return "
 					"function and not %s",
 					lua_typename (L,
 							lua_type (L, -1)));
+			lua_settop (L, 0);
+
 			return FALSE;
 		}
 	}
@@ -219,7 +218,7 @@ rspamadm_execute_lua_ucl_subr (gpointer pL, gint argc, gchar **argv,
 	err_idx = lua_gettop (L);
 
 	/* Push function */
-	lua_rawgeti (L, LUA_REGISTRYINDEX, cb_idx);
+	lua_pushvalue (L, -2);
 
 	/* Push argv */
 	lua_newtable (L);
@@ -240,15 +239,13 @@ rspamadm_execute_lua_ucl_subr (gpointer pL, gint argc, gchar **argv,
 			g_string_free (tb, TRUE);
 		}
 
-		lua_pop (L, 2);
+		lua_settop (L, 0);
 
 		return FALSE;
 	}
 
 	/* error function */
-	lua_pop (L, 1);
-
-	luaL_unref (L, LUA_REGISTRYINDEX, cb_idx);
+	lua_settop (L, 0);
 
 	return TRUE;
 }
-- 
2.39.5