Re: LuaSocket missing partial receives (Was: LuaSocket: No way to protect against fuzzing attacks?)

[Sean Conner <sean@...>]

It was thus said that the Great HyperHacker once stated:
> 
> Now, the LuaSocket manual says: "Also, after the error message, the
> function returns the partial result of the transmission." I took this
> to mean:
> result, error, partial_result = sock:receive()
> 
> Now am I crazy, or are there cases where "after the error message"
> actually means "appended to the error message string", e.g. you get an
> error like "timeout some_partial_string"? Because that didn't make
> much sense to me, but I could have sworn I saw it doing that and
> relied on this behaviour and it worked...
> 
> It looks like it is indeed returning the partial results after (as in,
> next in the return list) the error message. It's also interesting to
> note that if you do print(sock:receive(9999)), the string 'timeout' is
> exactly long enough to be separated from the following string by only
> one space, giving the impression that it's one long string. But still
> I could swear I actually did this, splitting the error message at the
> first space, and found my data there...
> 
> Maybe too much cola has just rotted my brain...

  Possibly.  I checked the code.  In buffer.c we have:

int buffer_meth_receive(lua_State *L, p_buffer buf) {

    /* ... */

    /* initialize buffer with optional extra prefix
     * (useful for concatenating previous partial results) */
    luaL_buffinit(L, &b);
    luaL_addlstring(&b, part, size);

    /* ... */

    if (err != IO_DONE) {
        /* we can't push anyting in the stack before pushing the
         * contents of the buffer. this is the reason for the complication */
        luaL_pushresult(&b);	/* -- buffer */
        lua_pushstring(L, buf->io->error(buf->io->ctx, err)); /* buffer -- buffer error */
        lua_pushvalue(L, -2);	/* buffer error -- buffer error buffer */
        lua_pushnil(L);		/* buffer error buffer -- buffer error buffer nil */
        lua_replace(L, -4);	/* buffer error buffer nil -- nil buffer error */
    } /* ... */

    /* ... */
}

I've annotated the stack gyrations (before -- after ) and indeed, it does
return results as

	result,error,partial = sock:receive()

It just so happens that the error string and the partial data might have
been laid out next to each other in a string pool somewhere (I haven't
looked into how Lua actually stores strings).  If LuaSocket is appending the
partial data to the error string, I haven't seen where that happens.

  -spc (Not that I looked through the code all that much ... )