Commit 472d8a0d authored by Oran Agra's avatar Oran Agra Committed by YaacovHazan
Browse files

Prevent pattern matching abuse (CVE-2024-31228)

parent 8ec5da78
...@@ -56,8 +56,11 @@ ...@@ -56,8 +56,11 @@
/* Glob-style pattern matching. */ /* Glob-style pattern matching. */
static int stringmatchlen_impl(const char *pattern, int patternLen, static int stringmatchlen_impl(const char *pattern, int patternLen,
const char *string, int stringLen, int nocase, int *skipLongerMatches) const char *string, int stringLen, int nocase, int *skipLongerMatches, int nesting)
{ {
/* Protection against abusive patterns. */
if (nesting > 1000) return 0;
while(patternLen && stringLen) { while(patternLen && stringLen) {
switch(pattern[0]) { switch(pattern[0]) {
case '*': case '*':
...@@ -69,7 +72,7 @@ static int stringmatchlen_impl(const char *pattern, int patternLen, ...@@ -69,7 +72,7 @@ static int stringmatchlen_impl(const char *pattern, int patternLen,
return 1; /* match */ return 1; /* match */
while(stringLen) { while(stringLen) {
if (stringmatchlen_impl(pattern+1, patternLen-1, if (stringmatchlen_impl(pattern+1, patternLen-1,
string, stringLen, nocase, skipLongerMatches)) string, stringLen, nocase, skipLongerMatches, nesting+1))
return 1; /* match */ return 1; /* match */
if (*skipLongerMatches) if (*skipLongerMatches)
return 0; /* no match */ return 0; /* no match */
...@@ -191,7 +194,7 @@ static int stringmatchlen_impl(const char *pattern, int patternLen, ...@@ -191,7 +194,7 @@ static int stringmatchlen_impl(const char *pattern, int patternLen,
int stringmatchlen(const char *pattern, int patternLen, int stringmatchlen(const char *pattern, int patternLen,
const char *string, int stringLen, int nocase) { const char *string, int stringLen, int nocase) {
int skipLongerMatches = 0; int skipLongerMatches = 0;
return stringmatchlen_impl(pattern,patternLen,string,stringLen,nocase,&skipLongerMatches); return stringmatchlen_impl(pattern,patternLen,string,stringLen,nocase,&skipLongerMatches,0);
} }
int stringmatch(const char *pattern, const char *string, int nocase) { int stringmatch(const char *pattern, const char *string, int nocase) {
......
...@@ -509,6 +509,12 @@ foreach {type large} [array get largevalue] { ...@@ -509,6 +509,12 @@ foreach {type large} [array get largevalue] {
r KEYS "a*a*a*a*a*a*a*a*a*a*a*a*a*a*a*a*a*a*a*a*b" r KEYS "a*a*a*a*a*a*a*a*a*a*a*a*a*a*a*a*a*a*a*a*b"
} {} } {}
test {Regression for pattern matching very long nested loops} {
r flushdb
r SET [string repeat "a" 50000] 1
r KEYS [string repeat "*?" 50000]
} {}
test {Coverage: basic SWAPDB test and unhappy path} { test {Coverage: basic SWAPDB test and unhappy path} {
r flushall r flushall
r select 0 r select 0
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment