On Thu, Oct 29, 2026 at 10:53:31PM -0700, Martin Mirchev wrote:
> Subject: [PATCH 0/2] httpclient/lua: fix the request headers conversion
> Hi,
>
> Here are two small fixes for the header conversion of the Lua
> httpclient, against current master (e5e52e33c). They follow up on
> 2db801c63 ("BUG/MINOR: hlua: fix stack overflow in httpclient headers
> conversion") and are attached (git format-patch).
>
> 1/2 BUG/MINOR: httpclient/lua: fix stack overread when copying the headers
> hlua_httpclient_table_to_hdrs() copies hdr_num + 1 entries out of a
> stack array of tune.http.maxhdr entries that has no terminator. Since
> 2db801c63 hdr_num can reach tune.http.maxhdr, so a request with
> exactly 101 header values reads one entry past the array (ASan:
> dynamic-stack-buffer-overflow READ of size 3264). Only hdr_num
> entries are copied now; the terminator is already set after the copy.
>
> 2/2 BUG/MINOR: httpclient/lua: raise an error on too many request headers
> With more than tune.http.maxhdr values, the early return leaves the
> outer lua_next() key and value on the stack, so the request fails
> with "invalid key to 'next'", and the duplicated values leak. The
> values are now freed and an explicit "too many headers" Lua error is
> raised, like the other argument errors.
>
> Tested on e5e52e33c with an ASan build (USE_LUA=1) and a Lua task
> calling core.httpclient():get() with 1, 101, 102 and 300 values for one
> header: on master 101 values trigger the ASan report, and without 2/2
> 300 values fail with "invalid key to 'next'"; with both patches 1 and
> 101 values send the request with no ASan report, and 102 and 300 fail
> with "too many headers (tune.http.maxhdr is 101)". Both should be
> backported where 2db801c63 was; before 3.5 the code is in src/hlua.c.
>
> These were found with an LLM-Enhanced Static Analysis Engine and verified
> manually.
>
> Martin Mirchev
Thanks, I merged both of them.
--
William Lallemand
