diff options
author | Oran Agra <oran@redislabs.com> | 2022-04-14 08:29:35 +0300 |
---|---|---|
committer | GitHub <noreply@github.com> | 2022-04-14 08:29:35 +0300 |
commit | 95050f2683173e2bb8b05b297e44809cd09316c6 (patch) | |
tree | 9293e95e76d8144b6f4d04a44d787c731b8d2e9b /src/rdb.c | |
parent | ca913a5de06bdcc323d0e109efbfa239496cc08d (diff) | |
download | redis-95050f2683173e2bb8b05b297e44809cd09316c6.tar.gz |
solve corrupt dump fuzzer crash in streams (#10579)
we had a panic in streamLastValidID when the stream metadata
said it's not empty, but the rax is empty.
Diffstat (limited to 'src/rdb.c')
-rw-r--r-- | src/rdb.c | 6 |
1 files changed, 6 insertions, 0 deletions
@@ -2433,6 +2433,12 @@ robj *rdbLoadObject(int rdbtype, rio *rdb, sds key, int dbid, int *error) { return NULL; } + if (s->length && !raxSize(s->rax)) { + rdbReportCorruptRDB("Stream length inconsistent with rax entries"); + decrRefCount(o); + return NULL; + } + /* Consumer groups loading */ uint64_t cgroups_count = rdbLoadLen(rdb,NULL); if (cgroups_count == RDB_LENERR) { |