summaryrefslogtreecommitdiff
path: root/src/rdb.c
diff options
context:
space:
mode:
authorOran Agra <oran@redislabs.com>2022-04-14 08:29:35 +0300
committerGitHub <noreply@github.com>2022-04-14 08:29:35 +0300
commit95050f2683173e2bb8b05b297e44809cd09316c6 (patch)
tree9293e95e76d8144b6f4d04a44d787c731b8d2e9b /src/rdb.c
parentca913a5de06bdcc323d0e109efbfa239496cc08d (diff)
downloadredis-95050f2683173e2bb8b05b297e44809cd09316c6.tar.gz
solve corrupt dump fuzzer crash in streams (#10579)
we had a panic in streamLastValidID when the stream metadata said it's not empty, but the rax is empty.
Diffstat (limited to 'src/rdb.c')
-rw-r--r--src/rdb.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/src/rdb.c b/src/rdb.c
index 0283630f7..7f2225dfb 100644
--- a/src/rdb.c
+++ b/src/rdb.c
@@ -2433,6 +2433,12 @@ robj *rdbLoadObject(int rdbtype, rio *rdb, sds key, int dbid, int *error) {
return NULL;
}
+ if (s->length && !raxSize(s->rax)) {
+ rdbReportCorruptRDB("Stream length inconsistent with rax entries");
+ decrRefCount(o);
+ return NULL;
+ }
+
/* Consumer groups loading */
uint64_t cgroups_count = rdbLoadLen(rdb,NULL);
if (cgroups_count == RDB_LENERR) {