Commit fe4eb9b1 authored by Oran Agra's avatar Oran Agra
Browse files

Integer Overflow in RAND commands can lead to assertion (CVE-2023-25155)

Issue happens when passing a negative long value that greater than
the max positive value that the long can store.

(cherry picked from commit 41430af6a821c551abb862666ef896f2c196dea6)
(cherry picked from commit f335f9c55e76c76531780c5bbf8805410b7b3ba4)
parent 8b565570
......@@ -626,6 +626,10 @@ void srandmemberWithCountCommand(client *c) {
dict *d;
if (getLongFromObjectOrReply(c,c->argv[2],&l,NULL) != C_OK) return;
if (l<-LONG_MAX) {
addReplyError(c, "value is out of range");
return;
}
if (l >= 0) {
count = (unsigned long) l;
} else {
......
......@@ -554,6 +554,11 @@ start_server {
r srandmember nonexisting_key 100
} {}
test "SRANDMEMBER count overflow" {
r sadd myset a
assert_error {*value is out of range*} {r srandmember myset -9223372036854775808}
} {}
foreach {type contents} {
hashtable {
1 5 10 50 125 50000 33959417 4775547 65434162
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment