Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
redis
Commits
cfb449cc
"doc/TwitterAlikeExample.html" did not exist on "37be27653817f0c4c18d695ceea082e0bb7bf462"
Unverified
Commit
cfb449cc
authored
Dec 14, 2020
by
Oran Agra
Committed by
GitHub
Dec 14, 2020
Browse files
Sanitize dump payload: excessive free on dup zset fields (#8189)
parent
7d9b09ad
Changes
2
Show whitespace changes
Inline
Side-by-side
src/rdb.c
View file @
cfb449cc
...
@@ -1659,7 +1659,7 @@ robj *rdbLoadObject(int rdbtype, rio *rdb, sds key) {
...
@@ -1659,7 +1659,7 @@ robj *rdbLoadObject(int rdbtype, rio *rdb, sds key) {
if (dictAdd(zs->dict,sdsele,&znode->score) != DICT_OK) {
if (dictAdd(zs->dict,sdsele,&znode->score) != DICT_OK) {
rdbReportCorruptRDB("Duplicate zset fields detected");
rdbReportCorruptRDB("Duplicate zset fields detected");
decrRefCount(o);
decrRefCount(o);
sdsfree(sdsele);
/* no need to free 'sdsele', will be released by zslFree together with 'o' */
return NULL;
return NULL;
}
}
}
}
...
...
tests/integration/corrupt-dump.tcl
View file @
cfb449cc
...
@@ -497,5 +497,15 @@ test {corrupt payload: fuzzer findings - valgrind negative malloc} {
...
@@ -497,5 +497,15 @@ test {corrupt payload: fuzzer findings - valgrind negative malloc} {
}
}
}
}
test
{
corrupt payload: fuzzer findings - valgrind invalid read
}
{
start_server
[
list overrides
[
list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no
]
]
{
r config set sanitize-dump-payload yes
r debug set-skip-checksum-validation 1
catch
{
r RESTORE _key 0
"
\x05\x0A\x02\x5F\x39\x00\x00\x00\x00\x00\x00\x22\x40\xC0\x08\x00\x00\x00\x00\x00\x00\x20\x40\x02\x5F\x37\x00\x00\x00\x00\x00\x00\x1C\x40\xC0\x06\x00\x00\x00\x00\x00\x00\x18\x40\x02\x5F\x33\x00\x00\x00\x00\x00\x00\x14\x40\xC0\x04\x00\x00\x00\x00\x00\x00\x10\x40\x02\x5F\x33\x00\x00\x00\x00\x00\x00\x08\x40\xC0\x02\x00\x00\x00\x00\x00\x00\x00\x40\x02\x5F\x31\x00\x00\x00\x00\x00\x00\xF0\x3F\xC0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x3C\x66\xD7\x14\xA9\xDA\x3C\x69
"
}
err
assert_match
"*Bad data format*"
$err
r ping
}
}
}
;
# tags
}
;
# tags
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment