Dragonfly crashes with SIGSEGV on ZRANGE with LIMIT parameters

[Naksen]

Describe
When executing a ZRANGE command with the LIMIT option on a sorted set, Dragonfly crashes with a segmentation fault (SIGSEGV). This causes the container to exit with code 139.

To Reproduce
Steps to reproduce the behavior:

1. Start a Dragonfly container with the following configuration:

services:
  dragonfly:
    image: 'docker.dragonflydb.io/dragonflydb/dragonfly'
    container_name: dragonfly
    environment:
      - DFLY_port=6379
      - DFLY_maxmemory=5.50GiB

2. Access the container shell:

docker exec -it dragonfly bash

3. Launch Redis CLI:

redis-cli

4. Insert data and run the problematic command:

zadd myzset 1 "one"
ZRANGE myzset 0 -1 LIMIT 2 10

5. Observe the container crash and exit.

Expected behavior
The ZRANGE command should return an empty result set (since index 2 is out of range for a single-element sorted set), and not crash the database.

Environment:

• Containerized: Docker Compose
• Dragonfly Version: latest (c534a25cd0fe, built ~2 weeks ago)

Additional context
Log output from the Dragonfly container includes a segmentation fault:

dragonfly  | I20250415 12:13:53.705840     1 init.cc:78] dragonfly running in opt mode.
dragonfly  |                    .--::--.                   
dragonfly  |    :+*=:          =@@@@@@@@=          :+*+:   
dragonfly  |   %@@@@@@%*=.     =@@@@@@@@-     .=*%@@@@@@#  
dragonfly  |   @@@@@@@@@@@@#+-. .%@@@@#. .-+#@@@@@@@@@@@%  
dragonfly  |   -@@@@@@@@@@@@@@@@*:#@@#:*@@@@@@@@@@@@@@@@-  
dragonfly  |     :+*********####-%@%%@%-####********++.    
dragonfly  |    .%@@@@@@@@@@@@@%:@@@@@@:@@@@@@@@@@@@@@%    
dragonfly  |    .@@@@@@@@%*+-:   =@@@@=  .:-+*%@@@@@@@%.   
dragonfly  |      =*+-:           ###*          .:-+*=     
dragonfly  |                      %@@%                     
dragonfly  |                      *@@*                     
dragonfly  |                      +@@=                     
dragonfly  |                      :##:                     
dragonfly  |                      :@@:                     
dragonfly  |                       @@                      
dragonfly  |                       ..                      
dragonfly  | * Logs will be written to the first available of the following paths:
dragonfly  | /tmp/dragonfly.*
dragonfly  | ./dragonfly.*
dragonfly  | * For the available flags type dragonfly [--help | --helpfull]
dragonfly  | * Documentation can be found at: https://www.dragonflydb.io/docs
dragonfly  | I20250415 12:13:53.706498     1 dfly_main.cc:749] Starting dragonfly df-v1.28.1-a87fe66d1a7654b8f2ee2b7fe27687d582230888
dragonfly  | W20250415 12:13:53.706990     1 dfly_main.cc:788] SWAP is enabled. Consider disabling it when running Dragonfly.
dragonfly  | I20250415 12:13:53.707486     1 dfly_main.cc:812] Max memory limit is: 5.50GiB
dragonfly  | I20250415 12:13:53.708020    11 uring_proactor.cc:285] IORing with 1024 entries, allocated 98368 bytes, cq_entries is 2048
dragonfly  | I20250415 12:13:53.709616     1 proactor_pool.cc:149] Running 11 io threads
dragonfly  | I20250415 12:13:53.720624     1 server_family.cc:829] Host OS: Linux 6.10.11-linuxkit aarch64 with 11 threads
dragonfly  | I20250415 12:13:53.721063     1 snapshot_storage.cc:182] Load snapshot: Searching for snapshot in directory: "/data"
dragonfly  | W20250415 12:13:53.721103     1 server_family.cc:928] Load snapshot: No snapshot found
dragonfly  | I20250415 12:13:53.724831    12 listener_interface.cc:101] sock[25] AcceptServer - listening on port 6379
dragonfly  | *** SIGSEGV received at time=1744719250 on cpu 5 ***
dragonfly  | PC: @     0xaaaae0bc1870  (unknown)  lpSkip
dragonfly  |     @     0xaaaae11a2214        480  absl::lts_20240722::AbslFailureSignalHandler()
dragonfly  |     @     0xffffa926d7a0       4960  (unknown)
dragonfly  |     @     0xaaaae0903014         32  dfly::container_utils::IterateSortedSet()
dragonfly  |     @     0xaaaae08dfc34        336  std::__detail::__variant::__gen_vtable_impl<>::__visit_invoke()
dragonfly  |     @     0xaaaae08e5e7c        224  absl::lts_20240722::functional_internal::InvokeObject<>()
dragonfly  |     @     0xaaaae0ac3758        320  dfly::Transaction::RunCallback()
dragonfly  |     @     0xaaaae0ac403c        288  dfly::Transaction::ScheduleInShard()
dragonfly  |     @     0xaaaae0ac4148        592  std::_Function_handler<>::_M_invoke()
dragonfly  |     @     0xaaaae0f93740         32  util::fb2::FiberQueue::Run()
dragonfly  |     @     0xaaaae0b1394c        304  boost::context::detail::fiber_entry<>()
dragonfly exited with code 139

[vyavdoshenko]

@Naksen
Thank you for reporting the issue.