Commit 6956d15b authored by Oran Agra's avatar Oran Agra
Browse files

Avoid assertion when MSETNX is used with the same key twice (CVE-2023-28425)

Using the same key twice in MSETNX command would trigger an assertion.

This reverts #11594 (introduced in Redis 7.0.8)
parent 66ff5e69
...@@ -561,7 +561,6 @@ void mgetCommand(client *c) { ...@@ -561,7 +561,6 @@ void mgetCommand(client *c) {
void msetGenericCommand(client *c, int nx) { void msetGenericCommand(client *c, int nx) {
int j; int j;
int setkey_flags = 0;
if ((c->argc % 2) == 0) { if ((c->argc % 2) == 0) {
addReplyErrorArity(c); addReplyErrorArity(c);
...@@ -577,12 +576,11 @@ void msetGenericCommand(client *c, int nx) { ...@@ -577,12 +576,11 @@ void msetGenericCommand(client *c, int nx) {
return; return;
} }
} }
setkey_flags |= SETKEY_DOESNT_EXIST;
} }
for (j = 1; j < c->argc; j += 2) { for (j = 1; j < c->argc; j += 2) {
c->argv[j+1] = tryObjectEncoding(c->argv[j+1]); c->argv[j+1] = tryObjectEncoding(c->argv[j+1]);
setKey(c, c->db, c->argv[j], c->argv[j + 1], setkey_flags); setKey(c, c->db, c->argv[j], c->argv[j + 1], 0);
notifyKeyspaceEvent(NOTIFY_STRING,"set",c->argv[j],c->db->id); notifyKeyspaceEvent(NOTIFY_STRING,"set",c->argv[j],c->db->id);
} }
server.dirty += (c->argc-1)/2; server.dirty += (c->argc-1)/2;
......
...@@ -234,6 +234,15 @@ start_server {tags {"string"}} { ...@@ -234,6 +234,15 @@ start_server {tags {"string"}} {
list [r msetnx x1{t} xxx y2{t} yyy] [r get x1{t}] [r get y2{t}] list [r msetnx x1{t} xxx y2{t} yyy] [r get x1{t}] [r get y2{t}]
} {1 xxx yyy} } {1 xxx yyy}
test {MSETNX with not existing keys - same key twice} {
r del x1{t}
list [r msetnx x1{t} xxx x1{t} yyy] [r get x1{t}]
} {1 yyy}
test {MSETNX with already existing keys - same key twice} {
list [r msetnx x1{t} xxx x1{t} zzz] [r get x1{t}]
} {0 yyy}
test "STRLEN against non-existing key" { test "STRLEN against non-existing key" {
assert_equal 0 [r strlen notakey] assert_equal 0 [r strlen notakey]
} }
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment