Unverified Commit b1939b05 authored by Oran Agra's avatar Oran Agra Committed by GitHub
Browse files

Integer Overflow in RAND commands can lead to assertion (CVE-2023-25155) (#11857)

Issue happens when passing a negative long value that greater than
the max positive value that the long can store.
parent dcbfcb91
...@@ -1120,13 +1120,13 @@ void hrandfieldCommand(client *c) { ...@@ -1120,13 +1120,13 @@ void hrandfieldCommand(client *c) {
listpackEntry ele; listpackEntry ele;
if (c->argc >= 3) { if (c->argc >= 3) {
if (getLongFromObjectOrReply(c,c->argv[2],&l,NULL) != C_OK) return; if (getRangeLongFromObjectOrReply(c,c->argv[2],-LONG_MAX,LONG_MAX,&l,NULL) != C_OK) return;
if (c->argc > 4 || (c->argc == 4 && strcasecmp(c->argv[3]->ptr,"withvalues"))) { if (c->argc > 4 || (c->argc == 4 && strcasecmp(c->argv[3]->ptr,"withvalues"))) {
addReplyErrorObject(c,shared.syntaxerr); addReplyErrorObject(c,shared.syntaxerr);
return; return;
} else if (c->argc == 4) { } else if (c->argc == 4) {
withvalues = 1; withvalues = 1;
if (l < LONG_MIN/2 || l > LONG_MAX/2) { if (l < -LONG_MAX/2 || l > LONG_MAX/2) {
addReplyError(c,"value is out of range"); addReplyError(c,"value is out of range");
return; return;
} }
......
...@@ -984,7 +984,7 @@ void srandmemberWithCountCommand(client *c) { ...@@ -984,7 +984,7 @@ void srandmemberWithCountCommand(client *c) {
dict *d; dict *d;
if (getLongFromObjectOrReply(c,c->argv[2],&l,NULL) != C_OK) return; if (getRangeLongFromObjectOrReply(c,c->argv[2],-LONG_MAX,LONG_MAX,&l,NULL) != C_OK) return;
if (l >= 0) { if (l >= 0) {
count = (unsigned long) l; count = (unsigned long) l;
} else { } else {
......
...@@ -4317,13 +4317,13 @@ void zrandmemberCommand(client *c) { ...@@ -4317,13 +4317,13 @@ void zrandmemberCommand(client *c) {
listpackEntry ele; listpackEntry ele;
if (c->argc >= 3) { if (c->argc >= 3) {
if (getLongFromObjectOrReply(c,c->argv[2],&l,NULL) != C_OK) return; if (getRangeLongFromObjectOrReply(c,c->argv[2],-LONG_MAX,LONG_MAX,&l,NULL) != C_OK) return;
if (c->argc > 4 || (c->argc == 4 && strcasecmp(c->argv[3]->ptr,"withscores"))) { if (c->argc > 4 || (c->argc == 4 && strcasecmp(c->argv[3]->ptr,"withscores"))) {
addReplyErrorObject(c,shared.syntaxerr); addReplyErrorObject(c,shared.syntaxerr);
return; return;
} else if (c->argc == 4) { } else if (c->argc == 4) {
withscores = 1; withscores = 1;
if (l < LONG_MIN/2 || l > LONG_MAX/2) { if (l < -LONG_MAX/2 || l > LONG_MAX/2) {
addReplyError(c,"value is out of range"); addReplyError(c,"value is out of range");
return; return;
} }
......
...@@ -74,6 +74,8 @@ start_server {tags {"hash"}} { ...@@ -74,6 +74,8 @@ start_server {tags {"hash"}} {
test "HRANDFIELD count overflow" { test "HRANDFIELD count overflow" {
r hmset myhash a 1 r hmset myhash a 1
assert_error {*value is out of range*} {r hrandfield myhash -9223372036854770000 withvalues} assert_error {*value is out of range*} {r hrandfield myhash -9223372036854770000 withvalues}
assert_error {*value is out of range*} {r hrandfield myhash -9223372036854775808 withvalues}
assert_error {*value is out of range*} {r hrandfield myhash -9223372036854775808}
} {} } {}
test "HRANDFIELD with <count> against non existing key" { test "HRANDFIELD with <count> against non existing key" {
......
...@@ -745,6 +745,11 @@ start_server { ...@@ -745,6 +745,11 @@ start_server {
r srandmember nonexisting_key 100 r srandmember nonexisting_key 100
} {} } {}
test "SRANDMEMBER count overflow" {
r sadd myset a
assert_error {*value is out of range*} {r srandmember myset -9223372036854775808}
} {}
# Make sure we can distinguish between an empty array and a null response # Make sure we can distinguish between an empty array and a null response
r readraw 1 r readraw 1
......
...@@ -2325,6 +2325,8 @@ start_server {tags {"zset"}} { ...@@ -2325,6 +2325,8 @@ start_server {tags {"zset"}} {
test "ZRANDMEMBER count overflow" { test "ZRANDMEMBER count overflow" {
r zadd myzset 0 a r zadd myzset 0 a
assert_error {*value is out of range*} {r zrandmember myzset -9223372036854770000 withscores} assert_error {*value is out of range*} {r zrandmember myzset -9223372036854770000 withscores}
assert_error {*value is out of range*} {r zrandmember myzset -9223372036854775808 withscores}
assert_error {*value is out of range*} {r zrandmember myzset -9223372036854775808}
} {} } {}
# Make sure we can distinguish between an empty array and a null response # Make sure we can distinguish between an empty array and a null response
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment