• Oran Agra's avatar
    Prevent unauthenticated client from easily consuming lots of memory (CVE-2021-32675) · 71be9729
    Oran Agra authored
    This change sets a low limit for multibulk and bulk length in the
    protocol for unauthenticated connections, so that they can't easily
    cause redis to allocate massive amounts of memory by sending just a few
    characters on the network.
    The new limits are 10 arguments of 16kb each (instead of 1m of 512mb)
    
    (cherry picked from commit 3d221e81f3b680543e34942579af190b049ff283)
    71be9729
networking.c 86.1 KB