summaryrefslogtreecommitdiff
path: root/src/t_set.c
diff options
context:
space:
mode:
authorBinbin <binloveplay1314@qq.com>2022-11-22 17:20:24 +0800
committerGitHub <noreply@github.com>2022-11-22 11:20:24 +0200
commit3f8756a06ae48258779ffc7cbef605a3ec0a926f (patch)
treeed1c60b5e87fd74b030362b9b60ee43296eaaba6 /src/t_set.c
parent0f85713174150044e17d2c4dfbcaaf7f7475f333 (diff)
downloadredis-3f8756a06ae48258779ffc7cbef605a3ec0a926f.tar.gz
Fix set with duplicate elements causes sdiff to hang (#11530)
This payload produces a set with duplicate elements (listpack encoding): ``` restore _key 0 "\x14\x25\x25\x00\x00\x00\x0A\x00\x06\x01\x82\x5F\x35\x03\x04\x01\x82\x5F\x31\x03\x82\x5F\x33\x03\x00\x01\x82\x5F\x39\x03\x82\x5F\x33\x03\x08\x01\x02\x01\xFF\x0B\x00\x31\xBE\x7D\x41\x01\x03\x5B\xEC" smembers key 1) "6" 2) "_5" 3) "4" 4) "_1" 5) "_3" ---> dup 6) "0" 7) "_9" 8) "_3" ---> dup 9) "8" 10) "2" ``` This kind of sets will cause SDIFF to hang, SDIFF generated a broken protocol and left the client hung. (Expected ten elements, but only got nine elements due to the duplication.) If we set `sanitize-dump-payload` to yes, we will be able to find the duplicate elements and report "ERR Bad data format". Discovered and discussed in #11290. This PR also improve prints when corrupt-dump-fuzzer hangs, it will print the cmds and the payload, an example like: ``` Testing integration/corrupt-dump-fuzzer [TIMEOUT]: clients state report follows. sock6 => (SPAWNED SERVER) pid:28884 Killing still running Redis server 28884 commands caused test to hang: SDIFF __key payload that caused test to hang: "\x14\balabala" ``` Co-authored-by: Oran Agra <oran@redislabs.com>
Diffstat (limited to 'src/t_set.c')
-rw-r--r--src/t_set.c3
1 files changed, 1 insertions, 2 deletions
diff --git a/src/t_set.c b/src/t_set.c
index 8ab602791..b56b38238 100644
--- a/src/t_set.c
+++ b/src/t_set.c
@@ -1493,8 +1493,7 @@ void sunionDiffGenericCommand(client *c, robj **setkeys, int setnum,
}
if (j == setnum) {
/* There is no other set with this element. Add it. */
- setTypeAddAux(dstset, str, len, llval, encoding == OBJ_ENCODING_HT);
- cardinality++;
+ cardinality += setTypeAddAux(dstset, str, len, llval, encoding == OBJ_ENCODING_HT);
}
}
setTypeReleaseIterator(si);