Skip to content

Conversation

ligurio
Copy link
Owner

@ligurio ligurio commented Oct 18, 2024

LuaJIT has a FFI library which allows calling external C functions and using C data structures from a pure Lua code, see [1].

According to a FFI API documentation [2] the Lua function ffi.cdef(def) adds multiple C declarations for types or external symbols (named variables or functions). def must be a Lua string. The contents of the string def must be a sequence of C declarations, separated by semicolons. The C parser complies to the C99 language standard plus the extensions described in [3].

Note, LuaJIT C parser is not a validating C parser. It expects and accepts correctly formed C declarations. Therefore without grammar-aware fuzzing we will face with a false-positive crashes.

The patch adds a grammar-aware test, where C declarations generated automatically using Protobuf grammar and LibProtoBuf-mutator and then serialize Protobuf structure to a string.

An example of bug in src/lj_cparse.c is LJ#1114.

  1. https://luajit.org/ext_ffi.html
  2. https://luajit.org/ext_ffi_api.html
  3. https://luajit.org/ext_ffi_semantics.html#clang
  4. https://luajit.org/ext_ffi_semantics.html#status

LuaJIT has a FFI library which allows calling external C functions
and using C data structures from a pure Lua code, see [1].

According to a FFI API documentation [2] the Lua function
`ffi.cdef(def)` adds multiple C declarations for types or
external symbols (named variables or functions). `def` must be
a Lua string. The contents of the string `def` must be a sequence
of C declarations, separated by semicolons. The C parser complies
to the C99 language standard plus the extensions described in [3].

Note, LuaJIT C parser is not a validating C parser. It expects and
accepts correctly formed C declarations. Therefore without
grammar-aware fuzzing we will face with a false-positive crashes.

The patch adds a grammar-aware test, where C declarations
generated automatically using Protobuf grammar and
LibProtoBuf-mutator and then serialize Protobuf structure to
a string. Note, an implementation is not finished yet.

An example of bug in `src/lj_cparse.c` is LJ#1114.

1. https://luajit.org/ext_ffi.html
2. https://luajit.org/ext_ffi_api.html
3. https://luajit.org/ext_ffi_semantics.html#clang
4. https://luajit.org/ext_ffi_semantics.html#status
@ligurio ligurio force-pushed the ligurio/introduce-ffi_cdef-test branch from ac31c8c to e4f8214 Compare October 18, 2024 08:08
@ligurio ligurio merged commit 8903286 into master Oct 18, 2024
9 of 11 checks passed
@ligurio ligurio deleted the ligurio/introduce-ffi_cdef-test branch October 18, 2024 09:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant