Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in
Toggle navigation
Menu
Open sidebar
ruanhaishen
redis
Commits
a2e8a3a2
Commit
a2e8a3a2
authored
Aug 20, 2021
by
sundb
Committed by
Oran Agra
Oct 04, 2021
Browse files
Sanitize dump payload: fix double free after insert dup nodekey to stream rax and returns 0 (#9399)
(cherry picked from commit
492d8d09
)
parent
2f8ec0e0
Changes
2
Show whitespace changes
Inline
Side-by-side
src/rdb.c
View file @
a2e8a3a2
...
...
@@ -2072,7 +2072,7 @@ robj *rdbLoadObject(int rdbtype, rio *rdb, sds key, int *error) {
}
/* Insert the key in the radix tree. */
int
retval
=
raxInsert
(
s
->
rax
,
int
retval
=
rax
Try
Insert
(
s
->
rax
,
(
unsigned
char
*
)
nodekey
,
sizeof
(
streamID
),
lp
,
NULL
);
sdsfree
(
nodekey
);
if
(
!
retval
)
{
...
...
@@ -2161,7 +2161,7 @@ robj *rdbLoadObject(int rdbtype, rio *rdb, sds key, int *error) {
streamFreeNACK
(
nack
);
return
NULL
;
}
if
(
!
raxInsert
(
cgroup
->
pel
,
rawid
,
sizeof
(
rawid
),
nack
,
NULL
))
{
if
(
!
rax
Try
Insert
(
cgroup
->
pel
,
rawid
,
sizeof
(
rawid
),
nack
,
NULL
))
{
rdbReportCorruptRDB
(
"Duplicated global PEL entry "
"loading stream consumer group"
);
decrRefCount
(
o
);
...
...
@@ -2225,11 +2225,12 @@ robj *rdbLoadObject(int rdbtype, rio *rdb, sds key, int *error) {
* loading the global PEL. Then set the same shared
* NACK structure also in the consumer-specific PEL. */
nack
->
consumer
=
consumer
;
if
(
!
raxInsert
(
consumer
->
pel
,
rawid
,
sizeof
(
rawid
),
nack
,
NULL
))
{
if
(
!
rax
Try
Insert
(
consumer
->
pel
,
rawid
,
sizeof
(
rawid
),
nack
,
NULL
))
{
rdbReportCorruptRDB
(
"Duplicated consumer PEL entry "
" loading a stream consumer "
"group"
);
decrRefCount
(
o
);
streamFreeNACK
(
nack
);
return
NULL
;
}
}
...
...
tests/integration/corrupt-dump.tcl
View file @
a2e8a3a2
...
...
@@ -688,5 +688,15 @@ test {corrupt payload: fuzzer findings - hash with len of 0} {
}
}
test
{
corrupt payload: fuzzer findings - stream double free listpack when insert dup node to rax returns 0
}
{
start_server
[
list overrides
[
list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no
]
]
{
r debug set-skip-checksum-validation 1
r config set sanitize-dump-payload yes
catch
{
r restore _stream 0
"
\x0F\x03\x10\x00\x00\x01\x7B\x60\x5A\x23\x79\x00\x00\x00\x00\x00\x00\x00\x00\xC3\x40\x4F\x40\x5C\x18\x5C\x00\x00\x00\x24\x00\x05\x01\x00\x01\x02\x01\x84\x69\x74\x65\x6D\x05\x85\x76\x61\x6C\x75\x65\x06\x40\x10\x00\x00\x20\x01\x00\x01\x20\x03\x00\x05\x20\x1C\x40\x09\x05\x01\x01\x82\x5F\x31\x03\x80\x0D\x00\x02\x20\x0D\x00\x02\xA0\x19\x00\x03\x20\x0B\x02\x82\x5F\x33\xA0\x19\x00\x04\x20\x0D\x00\x04\x20\x19\x00\xFF\x10\x00\x00\x01\x7B\x60\x5A\x23\x79\x00\x00\x00\x00\x00\x00\x00\x05\xC3\x40\x51\x40\x5E\x18\x5E\x00\x00\x00\x24\x00\x05\x01\x00\x01\x02\x01\x84\x69\x74\x65\x6D\x05\x85\x76\x61\x6C\x75\x65\x06\x40\x10\x00\x00\x20\x01\x06\x01\x01\x82\x5F\x35\x03\x05\x20\x1E\x40\x0B\x03\x01\x01\x06\x01\x80\x0B\x00\x02\x20\x0B\x02\x82\x5F\x37\xA0\x19\x00\x03\x20\x0D\x00\x08\xA0\x19\x00\x04\x20\x0B\x02\x82\x5F\x39\x20\x19\x00\xFF\x10\x00\x00\x01\x7B\x60\x5A\x23\x79\x00\x00\x00\x00\x00\x00\x00\x00\xC3\x3B\x40\x49\x18\x49\x00\x00\x00\x15\x00\x02\x01\x00\x01\x02\x01\x84\x69\x74\x65\x6D\x05\x85\x76\x61\x6C\x75\x65\x06\x40\x10\x00\x00\x20\x01\x40\x00\x00\x05\x20\x07\x40\x09\xC0\x22\x09\x01\x01\x86\x75\x6E\x69\x71\x75\x65\x07\xA0\x2C\x02\x08\x01\xFF\x0C\x81\x00\x00\x01\x7B\x60\x5A\x23\x7A\x01\x00\x09\x00\x9C\x8F\x1E\xBF\x2E\x05\x59\x09
"
replace
}
err
assert_match
"*Bad data format*"
$err
r ping
}
}
}
;
# tags
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment