Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
redis
Commits
472d8a0d
Commit
472d8a0d
authored
Oct 02, 2024
by
Oran Agra
Committed by
YaacovHazan
Oct 08, 2024
Browse files
Prevent pattern matching abuse (CVE-2024-31228)
parent
8ec5da78
Changes
2
Hide whitespace changes
Inline
Side-by-side
src/util.c
View file @
472d8a0d
...
...
@@ -56,8 +56,11 @@
/* Glob-style pattern matching. */
static
int
stringmatchlen_impl
(
const
char
*
pattern
,
int
patternLen
,
const
char
*
string
,
int
stringLen
,
int
nocase
,
int
*
skipLongerMatches
)
const
char
*
string
,
int
stringLen
,
int
nocase
,
int
*
skipLongerMatches
,
int
nesting
)
{
/* Protection against abusive patterns. */
if
(
nesting
>
1000
)
return
0
;
while
(
patternLen
&&
stringLen
)
{
switch
(
pattern
[
0
])
{
case
'*'
:
...
...
@@ -69,7 +72,7 @@ static int stringmatchlen_impl(const char *pattern, int patternLen,
return
1
;
/* match */
while
(
stringLen
)
{
if
(
stringmatchlen_impl
(
pattern
+
1
,
patternLen
-
1
,
string
,
stringLen
,
nocase
,
skipLongerMatches
))
string
,
stringLen
,
nocase
,
skipLongerMatches
,
nesting
+
1
))
return
1
;
/* match */
if
(
*
skipLongerMatches
)
return
0
;
/* no match */
...
...
@@ -191,7 +194,7 @@ static int stringmatchlen_impl(const char *pattern, int patternLen,
int
stringmatchlen
(
const
char
*
pattern
,
int
patternLen
,
const
char
*
string
,
int
stringLen
,
int
nocase
)
{
int
skipLongerMatches
=
0
;
return
stringmatchlen_impl
(
pattern
,
patternLen
,
string
,
stringLen
,
nocase
,
&
skipLongerMatches
);
return
stringmatchlen_impl
(
pattern
,
patternLen
,
string
,
stringLen
,
nocase
,
&
skipLongerMatches
,
0
);
}
int
stringmatch
(
const
char
*
pattern
,
const
char
*
string
,
int
nocase
)
{
...
...
tests/unit/keyspace.tcl
View file @
472d8a0d
...
...
@@ -509,6 +509,12 @@ foreach {type large} [array get largevalue] {
r KEYS
"a*a*a*a*a*a*a*a*a*a*a*a*a*a*a*a*a*a*a*a*b"
}
{}
test
{
Regression for pattern matching very long nested loops
}
{
r flushdb
r SET
[
string repeat
"a"
50000
]
1
r KEYS
[
string repeat
"*?"
50000
]
}
{}
test
{
Coverage: basic SWAPDB test and unhappy path
}
{
r flushall
r select 0
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment