Unverified Commit f7b1d028 authored by Oran Agra's avatar Oran Agra Committed by GitHub
Browse files

Fix possible corruption in sdsResize (CVE-2023-41056) (#12924)

#11766 introduced a bug in sdsResize where it could forget to update the
sds type in the sds header and then cause an overflow in sdsalloc. it
looks like the only implication of that is a possible assertion in HLL,
but it's hard to rule out possible heap corruption issues with
clientsCronResizeQueryBuffer
parent 8bb9a289
...@@ -349,20 +349,22 @@ sds sdsResize(sds s, size_t size, int would_regrow) { ...@@ -349,20 +349,22 @@ sds sdsResize(sds s, size_t size, int would_regrow) {
* type. */ * type. */
int use_realloc = (oldtype==type || (type < oldtype && type > SDS_TYPE_8)); int use_realloc = (oldtype==type || (type < oldtype && type > SDS_TYPE_8));
size_t newlen = use_realloc ? oldhdrlen+size+1 : hdrlen+size+1; size_t newlen = use_realloc ? oldhdrlen+size+1 : hdrlen+size+1;
int alloc_already_optimal = 0;
#if defined(USE_JEMALLOC) if (use_realloc) {
/* je_nallocx returns the expected allocation size for the newlen. int alloc_already_optimal = 0;
* We aim to avoid calling realloc() when using Jemalloc if there is no #if defined(USE_JEMALLOC)
* change in the allocation size, as it incurs a cost even if the /* je_nallocx returns the expected allocation size for the newlen.
* allocation size stays the same. */ * We aim to avoid calling realloc() when using Jemalloc if there is no
alloc_already_optimal = (je_nallocx(newlen, 0) == zmalloc_size(sh)); * change in the allocation size, as it incurs a cost even if the
#endif * allocation size stays the same. */
alloc_already_optimal = (je_nallocx(newlen, 0) == zmalloc_size(sh));
if (use_realloc && !alloc_already_optimal) { #endif
newsh = s_realloc(sh, newlen); if (!alloc_already_optimal) {
if (newsh == NULL) return NULL; newsh = s_realloc(sh, newlen);
s = (char*)newsh+oldhdrlen; if (newsh == NULL) return NULL;
} else if (!alloc_already_optimal) { s = (char*)newsh+oldhdrlen;
}
} else {
newsh = s_malloc(newlen); newsh = s_malloc(newlen);
if (newsh == NULL) return NULL; if (newsh == NULL) return NULL;
memcpy((char*)newsh+hdrlen, s, len); memcpy((char*)newsh+hdrlen, s, len);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment