diff options
author | Binbin <binloveplay1314@qq.com> | 2022-11-22 17:20:24 +0800 |
---|---|---|
committer | GitHub <noreply@github.com> | 2022-11-22 11:20:24 +0200 |
commit | 3f8756a06ae48258779ffc7cbef605a3ec0a926f (patch) | |
tree | ed1c60b5e87fd74b030362b9b60ee43296eaaba6 /src | |
parent | 0f85713174150044e17d2c4dfbcaaf7f7475f333 (diff) | |
download | redis-3f8756a06ae48258779ffc7cbef605a3ec0a926f.tar.gz |
Fix set with duplicate elements causes sdiff to hang (#11530)
This payload produces a set with duplicate elements (listpack encoding):
```
restore _key 0 "\x14\x25\x25\x00\x00\x00\x0A\x00\x06\x01\x82\x5F\x35\x03\x04\x01\x82\x5F\x31\x03\x82\x5F\x33\x03\x00\x01\x82\x5F\x39\x03\x82\x5F\x33\x03\x08\x01\x02\x01\xFF\x0B\x00\x31\xBE\x7D\x41\x01\x03\x5B\xEC"
smembers key
1) "6"
2) "_5"
3) "4"
4) "_1"
5) "_3" ---> dup
6) "0"
7) "_9"
8) "_3" ---> dup
9) "8"
10) "2"
```
This kind of sets will cause SDIFF to hang, SDIFF generated a broken
protocol and left the client hung. (Expected ten elements, but only
got nine elements due to the duplication.)
If we set `sanitize-dump-payload` to yes, we will be able to find
the duplicate elements and report "ERR Bad data format".
Discovered and discussed in #11290.
This PR also improve prints when corrupt-dump-fuzzer hangs, it will
print the cmds and the payload, an example like:
```
Testing integration/corrupt-dump-fuzzer
[TIMEOUT]: clients state report follows.
sock6 => (SPAWNED SERVER) pid:28884
Killing still running Redis server 28884
commands caused test to hang:
SDIFF __key
payload that caused test to hang: "\x14\balabala"
```
Co-authored-by: Oran Agra <oran@redislabs.com>
Diffstat (limited to 'src')
-rw-r--r-- | src/t_set.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/src/t_set.c b/src/t_set.c index 8ab602791..b56b38238 100644 --- a/src/t_set.c +++ b/src/t_set.c @@ -1493,8 +1493,7 @@ void sunionDiffGenericCommand(client *c, robj **setkeys, int setnum, } if (j == setnum) { /* There is no other set with this element. Add it. */ - setTypeAddAux(dstset, str, len, llval, encoding == OBJ_ENCODING_HT); - cardinality++; + cardinality += setTypeAddAux(dstset, str, len, llval, encoding == OBJ_ENCODING_HT); } } setTypeReleaseIterator(si); |