Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
redis
Commits
c8649f8e
Commit
c8649f8e
authored
Oct 02, 2024
by
Oran Agra
Browse files
Prevent pattern matching abuse (CVE-2024-31228)
parent
b351d5a3
Changes
2
Show whitespace changes
Inline
Side-by-side
src/util.c
View file @
c8649f8e
...
...
@@ -54,8 +54,11 @@
/* Glob-style pattern matching. */
static int stringmatchlen_impl(const char *pattern, int patternLen,
const char *string, int stringLen, int nocase, int *skipLongerMatches)
const char *string, int stringLen, int nocase, int *skipLongerMatches
, int nesting
)
{
/* Protection against abusive patterns. */
if (nesting > 1000) return 0;
while(patternLen && stringLen) {
switch(pattern[0]) {
case '*':
...
...
@@ -67,7 +70,7 @@ static int stringmatchlen_impl(const char *pattern, int patternLen,
return 1; /* match */
while(stringLen) {
if (stringmatchlen_impl(pattern+1, patternLen-1,
string, stringLen, nocase, skipLongerMatches))
string, stringLen, nocase, skipLongerMatches
, nesting+1
))
return 1; /* match */
if (*skipLongerMatches)
return 0; /* no match */
...
...
@@ -189,7 +192,7 @@ static int stringmatchlen_impl(const char *pattern, int patternLen,
int stringmatchlen(const char *pattern, int patternLen,
const char *string, int stringLen, int nocase) {
int skipLongerMatches = 0;
return stringmatchlen_impl(pattern,patternLen,string,stringLen,nocase,&skipLongerMatches);
return stringmatchlen_impl(pattern,patternLen,string,stringLen,nocase,&skipLongerMatches
,0
);
}
int stringmatch(const char *pattern, const char *string, int nocase) {
...
...
tests/unit/keyspace.tcl
View file @
c8649f8e
...
...
@@ -499,4 +499,10 @@ foreach {type large} [array get largevalue] {
r SET aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 1
r KEYS
"a*a*a*a*a*a*a*a*a*a*a*a*a*a*a*a*a*a*a*a*b"
}
{}
test
{
Regression for pattern matching very long nested loops
}
{
r flushdb
r SET
[
string repeat
"a"
50000
]
1
r KEYS
[
string repeat
"*?"
50000
]
}
{}
}
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment