Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Disable loading of binary chunks in Lua #3256

Open
pmatilai opened this issue Aug 27, 2024 · 0 comments
Open

Disable loading of binary chunks in Lua #3256

pmatilai opened this issue Aug 27, 2024 · 0 comments

Comments

@pmatilai
Copy link
Member

Quoting the Lua manual:

It is safe to load malformed binary chunks; load signals an appropriate error. However, Lua does not check the consistency of the code inside binary chunks; running maliciously crafted bytecode can crash the interpreter.

...and interpreter in our case is the rpm main process.

I don't know whether it's possible to stick a binary Lua chunk into one of our scriptlets in the header as such to get rpm to directly run it, but the Lua load() in our embedded environment is unrestricted. And rpm's own runner uses luaL_loadbuffer() which doesn't discriminate...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Status: Todo
Development

No branches or pull requests

1 participant