From 82f4883555a569fe537f9ed567e246b1e69c03b9 Mon Sep 17 00:00:00 2001
From: Victor Julien <vjulien@oisf.net>
Date: Fri, 4 Sep 2026 17:46:52 +0200
Subject: [PATCH] lua/datasets: validate string len

Address string size issue: LuaDatasetAdd() fetches a pointer from
lua_tostring(L,2) but takes an independent byte-count from lua_tonumber(L,3)
without comparing it to the real string length.

Check the real string len and pass that along.

Ticket: #8807.
---
 src/util-lua-dataset.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/src/util-lua-dataset.c b/src/util-lua-dataset.c
index 606b41061d..c4990374ff 100644
--- a/src/util-lua-dataset.c
+++ b/src/util-lua-dataset.c
@@ -76,14 +76,22 @@ static int LuaDatasetAdd(lua_State *luastate)
         LUA_ERROR("dataset is not initialized (call :get first)");
     }
 
-    const uint8_t *str = (const uint8_t *)lua_tostring(luastate, 2);
+    size_t real_len = 0;
+    const uint8_t *str = (const uint8_t *)lua_tolstring(luastate, 2, &real_len);
     if (str == NULL) {
-        LUA_ERROR("1st arg is not null string");
+        LUA_ERROR("1st arg is not a string");
     }
 
-    uint32_t str_len = lua_tonumber(luastate, 3);
+    if (!lua_isinteger(luastate, 3)) {
+        LUA_ERROR("2nd arg is not a string");
+    }
+    lua_Integer n = lua_tointeger(luastate, 3);
+    if (n < 0 || (size_t)n > real_len) {
+        LUA_ERROR("length out of range for supplied string");
+    }
+    uint32_t str_len = (uint32_t)n;
 
-    int r = SCDatasetAdd(s->set, (const uint8_t *)str, str_len);
+    int r = SCDatasetAdd(s->set, str, str_len);
     /* return value through luastate, as a luanumber */
     lua_pushnumber(luastate, (lua_Number)r);
     SCLogDebug("add:end");