oneof_field may be larger than oneof_count sometimes

[spacewander]

When decoding the protobuf data, sometimes I got a "table overflow" error. After debugging, I found the error is caused by https://github.com/starwing/lua-protobuf/blob/baac866bb9b88e4ccf66780fb86946bb25dafbf8/pb.c#L1173

By reading the code, I think it is expected that "t->oneof_field < t->oneof_count". In some situation, oneof_field may be larger than oneof_count, which causes a negative number of length and be casted into a huge number.

I haven't found a minimal reproducible example yet. Would you mind to give some suggestion?

[starwing]

Thanks for reporting, I'll look into it.

[starwing]

I could reproduce the issue with this code:

local pb = require "pb"

print(pb.loadfile("oneof.pb"))
for i = 1, 20 do
   pb.clear("TestOneOf", "a1")
   print(pb.loadfile("oneof.pb"))
end

print(require "serpent".block(pb.decode("TestOneOf", "")))

while the oneof.pb file is the binary format of below proto:

syntax = "proto3";

message TestOneOf {
  oneof OneOf1 {
    int32 a1 = 1;
  }
}

but in my case Lua does not crash because of the check below: https://github.com/lua/lua/blob/be908a7d4d8130264ad67c5789169769f824c5d1/lapi.c#L768

But it did need to fix.

[spacewander]

We found this issue with LuaJIT. It may be caused by the difference between LuaJIT and Lua.

[spacewander]

@starwing Look like this issue is fixed in https://github.com/starwing/lua-protobuf/commit/2a2b0b95117642ad9470bfe0add7dd6ce82f3869. Thanks for your quick response!

Would you please create a new release for it? Thanks again!

[spacewander]

Ping @starwing We are looking forward to a new release 😆

[starwing]

Ping @starwing

We are looking forward to a new release 😆

There is already a new release here. It's 0.4.1, you could check it in luarocks.org. It's just a tag so do not display in releases of GitHub.

[spacewander]

Thanks!