Commit 37b3b2a7 authored by Oran Agra's avatar Oran Agra
Browse files

Fix range issues in ZRANDMEMBER and HRANDFIELD (CVE-2023-22458)

missing range check in ZRANDMEMBER and HRANDIFLD leading to panic due
to protocol limitations
parent 54538998
...@@ -1196,8 +1196,13 @@ void hrandfieldCommand(client *c) { ...@@ -1196,8 +1196,13 @@ void hrandfieldCommand(client *c) {
if (c->argc > 4 || (c->argc == 4 && strcasecmp(c->argv[3]->ptr,"withvalues"))) { if (c->argc > 4 || (c->argc == 4 && strcasecmp(c->argv[3]->ptr,"withvalues"))) {
addReplyErrorObject(c,shared.syntaxerr); addReplyErrorObject(c,shared.syntaxerr);
return; return;
} else if (c->argc == 4) } else if (c->argc == 4) {
withvalues = 1; withvalues = 1;
if (l < LONG_MIN/2 || l > LONG_MAX/2) {
addReplyError(c,"value is out of range");
return;
}
}
hrandfieldWithCountCommand(c, l, withvalues); hrandfieldWithCountCommand(c, l, withvalues);
return; return;
} }
......
...@@ -4242,8 +4242,13 @@ void zrandmemberCommand(client *c) { ...@@ -4242,8 +4242,13 @@ void zrandmemberCommand(client *c) {
if (c->argc > 4 || (c->argc == 4 && strcasecmp(c->argv[3]->ptr,"withscores"))) { if (c->argc > 4 || (c->argc == 4 && strcasecmp(c->argv[3]->ptr,"withscores"))) {
addReplyErrorObject(c,shared.syntaxerr); addReplyErrorObject(c,shared.syntaxerr);
return; return;
} else if (c->argc == 4) } else if (c->argc == 4) {
withscores = 1; withscores = 1;
if (l < LONG_MIN/2 || l > LONG_MAX/2) {
addReplyError(c,"value is out of range");
return;
}
}
zrandmemberWithCountCommand(c, l, withscores); zrandmemberWithCountCommand(c, l, withscores);
return; return;
} }
......
...@@ -68,6 +68,11 @@ start_server {tags {"hash"}} { ...@@ -68,6 +68,11 @@ start_server {tags {"hash"}} {
r hrandfield myhash 0 r hrandfield myhash 0
} {} } {}
test "HRANDFIELD count overflow" {
r hmset myhash a 1
assert_error {*value is out of range*} {r hrandfield myhash -9223372036854770000 withvalues}
} {}
test "HRANDFIELD with <count> against non existing key" { test "HRANDFIELD with <count> against non existing key" {
r hrandfield nonexisting_key 100 r hrandfield nonexisting_key 100
} {} } {}
......
...@@ -1735,6 +1735,11 @@ start_server {tags {"zset"}} { ...@@ -1735,6 +1735,11 @@ start_server {tags {"zset"}} {
r zrandmember nonexisting_key 100 r zrandmember nonexisting_key 100
} {} } {}
test "ZRANDMEMBER count overflow" {
r zadd myzset 0 a
assert_error {*value is out of range*} {r zrandmember myzset -9223372036854770000 withscores}
} {}
# Make sure we can distinguish between an empty array and a null response # Make sure we can distinguish between an empty array and a null response
r readraw 1 r readraw 1
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment