Skip to content

[CRASH] Crash in zrandmember #631

@yype

Description

@yype

Reproduce

zadd myset 1 one
zrandmember myset -9223372036854775808

Backtrace

=== ASSERTION FAILED ===
==> networking.cpp:917 'length >= 0' is not true

------ STACK TRACE ------

Backtrace:
keydb-server *:6379(addReplyAggregateLen(client*, long, int)+0x30) [0x5555556b6e60]
keydb-server *:6379(zrandmemberWithCountCommand(client*, long, int)+0x1ec) [0x55555575e5fc]
keydb-server *:6379(zrandmemberCommand(client*)+0xd9) [0x55555575ec99]
keydb-server *:6379(call(client*, int)+0xb1) [0x555555767ae1]
keydb-server *:6379(processCommand(client*, int)+0x954) [0x555555768c64]
keydb-server *:6379(processCommandAndResetClient(client*, int)+0x66) [0x5555556afef6]
keydb-server *:6379(processInputBuffer(client*, bool, int)+0x174) [0x5555556b6084]
keydb-server *:6379(processClients()+0xd9) [0x5555556b6219]
keydb-server *:6379(+0x19ab62) [0x5555556eeb62]
keydb-server *:6379(beforeSleep(aeEventLoop*)+0x160) [0x55555569b330]
keydb-server *:6379(aeProcessEvents+0x10b) [0x555555695b0b]
keydb-server *:6379(aeMain+0x47) [0x55555569c4e7]
keydb-server *:6379(workerThreadMain(void*)+0x73) [0x55555576a5b3]
/lib/x86_64-linux-gnu/libpthread.so.0(+0x76db) [0x7ffff5c4b6db]
/lib/x86_64-linux-gnu/libc.so.6(clone+0x3f) [0x7ffff597461f]

Aditional information

  1. The crash can be reproduced on the keydb 6.3.2 docker image.
  2. A similar crash was also found in redis and has already been patched. The related PR commit can be found at Integer Overflow in RAND commands can lead to assertion (CVE-2023-25155) redis/redis#11857, which might help with implementing the fix for keydb.

Thanks.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions