Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
redis
Commits
c8649f8e
Commit
c8649f8e
authored
Oct 02, 2024
by
Oran Agra
Browse files
Prevent pattern matching abuse (CVE-2024-31228)
parent
b351d5a3
Changes
2
Hide whitespace changes
Inline
Side-by-side
src/util.c
View file @
c8649f8e
...
...
@@ -54,8 +54,11 @@
/* Glob-style pattern matching. */
static
int
stringmatchlen_impl
(
const
char
*
pattern
,
int
patternLen
,
const
char
*
string
,
int
stringLen
,
int
nocase
,
int
*
skipLongerMatches
)
const
char
*
string
,
int
stringLen
,
int
nocase
,
int
*
skipLongerMatches
,
int
nesting
)
{
/* Protection against abusive patterns. */
if
(
nesting
>
1000
)
return
0
;
while
(
patternLen
&&
stringLen
)
{
switch
(
pattern
[
0
])
{
case
'*'
:
...
...
@@ -67,7 +70,7 @@ static int stringmatchlen_impl(const char *pattern, int patternLen,
return
1
;
/* match */
while
(
stringLen
)
{
if
(
stringmatchlen_impl
(
pattern
+
1
,
patternLen
-
1
,
string
,
stringLen
,
nocase
,
skipLongerMatches
))
string
,
stringLen
,
nocase
,
skipLongerMatches
,
nesting
+
1
))
return
1
;
/* match */
if
(
*
skipLongerMatches
)
return
0
;
/* no match */
...
...
@@ -189,7 +192,7 @@ static int stringmatchlen_impl(const char *pattern, int patternLen,
int
stringmatchlen
(
const
char
*
pattern
,
int
patternLen
,
const
char
*
string
,
int
stringLen
,
int
nocase
)
{
int
skipLongerMatches
=
0
;
return
stringmatchlen_impl
(
pattern
,
patternLen
,
string
,
stringLen
,
nocase
,
&
skipLongerMatches
);
return
stringmatchlen_impl
(
pattern
,
patternLen
,
string
,
stringLen
,
nocase
,
&
skipLongerMatches
,
0
);
}
int
stringmatch
(
const
char
*
pattern
,
const
char
*
string
,
int
nocase
)
{
...
...
tests/unit/keyspace.tcl
View file @
c8649f8e
...
...
@@ -499,4 +499,10 @@ foreach {type large} [array get largevalue] {
r SET aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 1
r KEYS
"a*a*a*a*a*a*a*a*a*a*a*a*a*a*a*a*a*a*a*a*b"
}
{}
test
{
Regression for pattern matching very long nested loops
}
{
r flushdb
r SET
[
string repeat
"a"
50000
]
1
r KEYS
[
string repeat
"*?"
50000
]
}
{}
}
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment