gvsafronov/futriix
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Sanitize dump payload: excessive free on dup zset fields (#8189)

Browse Source
This commit is contained in:
Oran Agra 2020-12-14 17:10:31 +02:00 committed by GitHub
parent 7d9b09adaa
commit cfb449cc80
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/rdb.c
View File

@ -1659,7 +1659,7 @@ robj *rdbLoadObject(int rdbtype, rio *rdb, sds key) {
if (dictAdd(zs->dict,sdsele,&znode->score) != DICT_OK) {
rdbReportCorruptRDB("Duplicate zset fields detected");
decrRefCount(o);
sdsfree(sdsele);
/* no need to free 'sdsele', will be released by zslFree together with 'o' */
return NULL;
}
}

10
tests/integration/corrupt-dump.tcl
View File

@ -497,5 +497,15 @@ test {corrupt payload: fuzzer findings - valgrind negative malloc} {
}
}
test {corrupt payload: fuzzer findings - valgrind invalid read} {
start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
r config set sanitize-dump-payload yes
r debug set-skip-checksum-validation 1
catch {r RESTORE _key 0 "\x05\x0A\x02\x5F\x39\x00\x00\x00\x00\x00\x00\x22\x40\xC0\x08\x00\x00\x00\x00\x00\x00\x20\x40\x02\x5F\x37\x00\x00\x00\x00\x00\x00\x1C\x40\xC0\x06\x00\x00\x00\x00\x00\x00\x18\x40\x02\x5F\x33\x00\x00\x00\x00\x00\x00\x14\x40\xC0\x04\x00\x00\x00\x00\x00\x00\x10\x40\x02\x5F\x33\x00\x00\x00\x00\x00\x00\x08\x40\xC0\x02\x00\x00\x00\x00\x00\x00\x00\x40\x02\x5F\x31\x00\x00\x00\x00\x00\x00\xF0\x3F\xC0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x3C\x66\xD7\x14\xA9\xDA\x3C\x69"} err
assert_match "*Bad data format*" $err
r ping
}
}
} ;# tags