Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Memory limit + untrusted user input can lead to abort on Luau #488

Closed
cheesycod opened this issue Nov 26, 2024 · 3 comments
Closed

Memory limit + untrusted user input can lead to abort on Luau #488

cheesycod opened this issue Nov 26, 2024 · 3 comments

Comments

@cheesycod
Copy link

cheesycod commented Nov 26, 2024

Code:

function a(n)
    return a(n)
end

a(19283)

Rust-side code:

    let lua = Lua::new_with(
        LuaStdLib::ALL_SAFE,
        LuaOptions::new().catch_rust_panics(true),
    )?;

    let compiler = mlua::Compiler::new()
        .set_optimization_level(2)
        .set_type_info_level(1);
    lua.set_compiler(compiler.clone());

    lua.sandbox(true)?; // We explicitly want globals to be shared across all scripts in this VM
    lua.set_memory_limit(MAX_TEMPLATE_MEMORY_USAGE)?;


   // After a ton of boiler plate code...
                                    let v: LuaValue = match tis_ref
                                        .lua
                                        .load(&template_bytecode)
                                        .set_name(&exec_name)
                                        .set_mode(mlua::ChunkMode::Binary) // Ensure auto-detection never selects binary mode
                                        .call_async((event, token.clone()))
                                        .await
                                    {
                                        Ok(f) => f,
                                        Err(e) => {
                                            let _ = callback.send(LuaVmResult::LuaError {
                                                err: e,
                                            });
        
                                            while let Err(e) = state::remove_template(&tis_ref.lua, &token) {
                                                log::error!("Could not remove template: {}. Trying again in 1 second", e);
                                                tokio::time::sleep(std::time::Duration::from_secs(1)).await;
                                            };
        
                                            return;
                                        }
                                    };

Leads to the following error:

Nov 26 00:22:22 Hepatitis rust.bot[2027332]: (templating::lang_lua::event) INFO - Event: Serializing data
Nov 26 00:22:22 Hepatitis rust.bot[2027332]: (silverpelt::ar_event) ERROR - Error in dispatch_event_to_modules: memory error: <nil>
Nov 26 00:22:22 Hepatitis rust.bot[2027332]: (rust_bot) ERROR - Error dispatching event to modules: memory error: <nil>
Nov 26 00:22:23 Hepatitis rust.bot[2027332]: fatal runtime error: Rust cannot catch foreign exceptions
Nov 26 00:22:23 Hepatitis rust.bot[2027332]: (silverpelt::ar_event) ERROR - Error in dispatch_event_to_modules: Could not receive data from Lua thread
Nov 26 00:22:23 Hepatitis rust.bot[2027332]: (rust_bot) ERROR - Error dispatching event to modules: Could not receive data from Lua thread

<PROCESS RESTARTS HERE>
@cheesycod
Copy link
Author

st.txt

Heres the stack trace BTW for where this error happens @khvzak

@khvzak
Copy link
Member

khvzak commented Nov 27, 2024

Could you try the latest main branch? Hope it will fix the issue

@cheesycod
Copy link
Author

Could you try the latest main branch? Hope it will fix the issue

With this commit, I no longer see this issue anymore (at least, as of now)

@khvzak khvzak closed this as completed Dec 1, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants