From e663a6e326c3d4d465d5aa66e4fbe3acde69aac3 Mon Sep 17 00:00:00 2001
From: Christopher Faulet <cfaulet@haproxy.com>
Date: Fri, 7 Aug 2020 09:11:22 +0200
Subject: [PATCH] BUG/MINOR: lua: Check argument type to convert it to IP mask
 in arg validation

In hlua_lua2arg_check() function, before converting an argument to an IPv4 or
IPv6 mask, we must be sure to have an integer or a string argument (ARGT_SINT or
ARGT_STR).

This patch must be backported to all supported versions.
---
 src/hlua.c | 32 ++++++++++++++++++++++----------
 1 file changed, 22 insertions(+), 10 deletions(-)

diff --git a/src/hlua.c b/src/hlua.c
index f99bdf9d2..f31f318a1 100644
--- a/src/hlua.c
+++ b/src/hlua.c
@@ -752,11 +752,17 @@ __LJMP int hlua_lua2arg_check(lua_State *L, int first, struct arg *argp,
 			break;
 
 		case ARGT_MSK4:
-			memcpy(trash.area, argp[idx].data.str.area,
-			       argp[idx].data.str.data);
-			trash.area[argp[idx].data.str.data] = 0;
-			if (!str2mask(trash.area, &argp[idx].data.ipv4))
-				WILL_LJMP(luaL_argerror(L, first + idx, "invalid IPv4 mask"));
+			if (argp[idx].type == ARGT_SINT)
+				len2mask4(argp[idx].data.sint, &argp[idx].data.ipv4);
+			else if (argp[idx].type == ARGT_STR) {
+				memcpy(trash.area, argp[idx].data.str.area,
+				       argp[idx].data.str.data);
+				trash.area[argp[idx].data.str.data] = 0;
+				if (!str2mask(trash.area, &argp[idx].data.ipv4))
+					WILL_LJMP(luaL_argerror(L, first + idx, "invalid IPv4 mask"));
+			}
+			else
+				WILL_LJMP(luaL_argerror(L, first + idx, "integer or string expected"));
 			argp[idx].type = ARGT_MSK4;
 			break;
 
@@ -772,11 +778,17 @@ __LJMP int hlua_lua2arg_check(lua_State *L, int first, struct arg *argp,
 			break;
 
 		case ARGT_MSK6:
-			memcpy(trash.area, argp[idx].data.str.area,
-			       argp[idx].data.str.data);
-			trash.area[argp[idx].data.str.data] = 0;
-			if (!str2mask6(trash.area, &argp[idx].data.ipv6))
-				WILL_LJMP(luaL_argerror(L, first + idx, "invalid IPv6 mask"));
+			if (argp[idx].type == ARGT_SINT)
+				len2mask6(argp[idx].data.sint, &argp[idx].data.ipv6);
+			else if (argp[idx].type == ARGT_STR) {
+				memcpy(trash.area, argp[idx].data.str.area,
+				       argp[idx].data.str.data);
+				trash.area[argp[idx].data.str.data] = 0;
+				if (!str2mask6(trash.area, &argp[idx].data.ipv6))
+					WILL_LJMP(luaL_argerror(L, first + idx, "invalid IPv6 mask"));
+			}
+			else
+				WILL_LJMP(luaL_argerror(L, first + idx, "integer or string expected"));
 			argp[idx].type = ARGT_MSK6;
 			break;