Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in
Toggle navigation
Menu
Open sidebar
ruanhaishen
redis
Commits
492d8d09
Unverified
Commit
492d8d09
authored
Aug 20, 2021
by
sundb
Committed by
GitHub
Aug 20, 2021
Browse files
Sanitize dump payload: fix double free after insert dup nodekey to stream rax and returns 0 (#9399)
parent
1d9c8d61
Changes
2
Hide whitespace changes
Inline
Side-by-side
src/rdb.c
View file @
492d8d09
...
@@ -2081,7 +2081,7 @@ robj *rdbLoadObject(int rdbtype, rio *rdb, sds key, int dbid, int *error) {
...
@@ -2081,7 +2081,7 @@ robj *rdbLoadObject(int rdbtype, rio *rdb, sds key, int dbid, int *error) {
}
}
/* Insert the key in the radix tree. */
/* Insert the key in the radix tree. */
int
retval
=
raxInsert
(
s
->
rax
,
int
retval
=
rax
Try
Insert
(
s
->
rax
,
(
unsigned
char
*
)
nodekey
,
sizeof
(
streamID
),
lp
,
NULL
);
(
unsigned
char
*
)
nodekey
,
sizeof
(
streamID
),
lp
,
NULL
);
sdsfree
(
nodekey
);
sdsfree
(
nodekey
);
if
(
!
retval
)
{
if
(
!
retval
)
{
...
@@ -2170,7 +2170,7 @@ robj *rdbLoadObject(int rdbtype, rio *rdb, sds key, int dbid, int *error) {
...
@@ -2170,7 +2170,7 @@ robj *rdbLoadObject(int rdbtype, rio *rdb, sds key, int dbid, int *error) {
streamFreeNACK
(
nack
);
streamFreeNACK
(
nack
);
return
NULL
;
return
NULL
;
}
}
if
(
!
raxInsert
(
cgroup
->
pel
,
rawid
,
sizeof
(
rawid
),
nack
,
NULL
))
{
if
(
!
rax
Try
Insert
(
cgroup
->
pel
,
rawid
,
sizeof
(
rawid
),
nack
,
NULL
))
{
rdbReportCorruptRDB
(
"Duplicated global PEL entry "
rdbReportCorruptRDB
(
"Duplicated global PEL entry "
"loading stream consumer group"
);
"loading stream consumer group"
);
decrRefCount
(
o
);
decrRefCount
(
o
);
...
@@ -2234,11 +2234,12 @@ robj *rdbLoadObject(int rdbtype, rio *rdb, sds key, int dbid, int *error) {
...
@@ -2234,11 +2234,12 @@ robj *rdbLoadObject(int rdbtype, rio *rdb, sds key, int dbid, int *error) {
* loading the global PEL. Then set the same shared
* loading the global PEL. Then set the same shared
* NACK structure also in the consumer-specific PEL. */
* NACK structure also in the consumer-specific PEL. */
nack
->
consumer
=
consumer
;
nack
->
consumer
=
consumer
;
if
(
!
raxInsert
(
consumer
->
pel
,
rawid
,
sizeof
(
rawid
),
nack
,
NULL
))
{
if
(
!
rax
Try
Insert
(
consumer
->
pel
,
rawid
,
sizeof
(
rawid
),
nack
,
NULL
))
{
rdbReportCorruptRDB
(
"Duplicated consumer PEL entry "
rdbReportCorruptRDB
(
"Duplicated consumer PEL entry "
" loading a stream consumer "
" loading a stream consumer "
"group"
);
"group"
);
decrRefCount
(
o
);
decrRefCount
(
o
);
streamFreeNACK
(
nack
);
return
NULL
;
return
NULL
;
}
}
}
}
...
...
tests/integration/corrupt-dump.tcl
View file @
492d8d09
...
@@ -716,5 +716,15 @@ test {corrupt payload: fuzzer findings - hash listpack first element too long en
...
@@ -716,5 +716,15 @@ test {corrupt payload: fuzzer findings - hash listpack first element too long en
}
}
}
}
test
{
corrupt payload: fuzzer findings - stream double free listpack when insert dup node to rax returns 0
}
{
start_server
[
list overrides
[
list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no
]
]
{
r debug set-skip-checksum-validation 1
r config set sanitize-dump-payload yes
catch
{
r restore _stream 0
"
\x0F\x03\x10\x00\x00\x01\x7B\x60\x5A\x23\x79\x00\x00\x00\x00\x00\x00\x00\x00\xC3\x40\x4F\x40\x5C\x18\x5C\x00\x00\x00\x24\x00\x05\x01\x00\x01\x02\x01\x84\x69\x74\x65\x6D\x05\x85\x76\x61\x6C\x75\x65\x06\x40\x10\x00\x00\x20\x01\x00\x01\x20\x03\x00\x05\x20\x1C\x40\x09\x05\x01\x01\x82\x5F\x31\x03\x80\x0D\x00\x02\x20\x0D\x00\x02\xA0\x19\x00\x03\x20\x0B\x02\x82\x5F\x33\xA0\x19\x00\x04\x20\x0D\x00\x04\x20\x19\x00\xFF\x10\x00\x00\x01\x7B\x60\x5A\x23\x79\x00\x00\x00\x00\x00\x00\x00\x05\xC3\x40\x51\x40\x5E\x18\x5E\x00\x00\x00\x24\x00\x05\x01\x00\x01\x02\x01\x84\x69\x74\x65\x6D\x05\x85\x76\x61\x6C\x75\x65\x06\x40\x10\x00\x00\x20\x01\x06\x01\x01\x82\x5F\x35\x03\x05\x20\x1E\x40\x0B\x03\x01\x01\x06\x01\x80\x0B\x00\x02\x20\x0B\x02\x82\x5F\x37\xA0\x19\x00\x03\x20\x0D\x00\x08\xA0\x19\x00\x04\x20\x0B\x02\x82\x5F\x39\x20\x19\x00\xFF\x10\x00\x00\x01\x7B\x60\x5A\x23\x79\x00\x00\x00\x00\x00\x00\x00\x00\xC3\x3B\x40\x49\x18\x49\x00\x00\x00\x15\x00\x02\x01\x00\x01\x02\x01\x84\x69\x74\x65\x6D\x05\x85\x76\x61\x6C\x75\x65\x06\x40\x10\x00\x00\x20\x01\x40\x00\x00\x05\x20\x07\x40\x09\xC0\x22\x09\x01\x01\x86\x75\x6E\x69\x71\x75\x65\x07\xA0\x2C\x02\x08\x01\xFF\x0C\x81\x00\x00\x01\x7B\x60\x5A\x23\x7A\x01\x00\x0A\x00\x9C\x8F\x1E\xBF\x2E\x05\x59\x09
"
replace
}
err
assert_match
"*Bad data format*"
$err
r ping
}
}
}
;
# tags
}
;
# tags
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment