bugfix: shdict ffi store/incr silently truncated keys > 65535 bytes.

ngx_stream_lua_shdict_node_t::key_len is a u_short (uint16). The
ngx_stream_lua_ffi_shdict_store() and ngx_stream_lua_ffi_shdict_incr()
entry points accepted key_len as size_t and assigned it through a
(u_short) cast without bounds-checking, so a key longer than 65535
bytes was silently truncated when stored on the node, while the slab
allocation and the key memcpy still used the untruncated length.

The truncated sd->key_len was later used as an offset to locate the
value, landing inside the key bytes and reading the wrong data or
going past the value.

Mirror the > 65535 check already enforced by the Lua-stack API path
(see ngx_stream_lua_shdict_set_helper) at the FFI entry points so the
truncating cast is unreachable.

Mirrors the fix in lua-nginx-module.

Author: zhuizhuhaomeng

src/ngx_stream_lua_shdict.c

@@ -1244,6 +1244,11 @@ ngx_stream_lua_ffi_shdict_store(ngx_shm_zone_t *zone, int op, u_char *key,
 
     dd("exptime: %ld", exptime);
 
+    if (key_len > 65535) {
+        *errmsg = "key too long";
+        return NGX_ERROR;
+    }
+
     ctx = zone->data;
 
     *forcible = 0;
@@ -1651,6 +1656,11 @@ ngx_stream_lua_ffi_shdict_incr(ngx_shm_zone_t *zone, u_char *key,
         tp = ngx_timeofday();
     }
 
+    if (key_len > 65535) {
+        *err = "key too long";
+        return NGX_ERROR;
+    }
+
     ctx = zone->data;
 
     *forcible = 0;