diff options
| author | Oran Agra <oran@redislabs.com> | 2021-11-22 15:30:00 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-11-22 15:30:00 +0200 |
| commit | f07dedf73facfed5044efaf2a7a780581bf73ffa (patch) | |
| tree | ca1b1efdf3debb3835cd80b42a3e47d5e86206f3 /tests/modules | |
| parent | f00a8ad93c8ebaef3c8e9856385cdd5587827c0b (diff) | |
| download | redis-f07dedf73facfed5044efaf2a7a780581bf73ffa.tar.gz | |
Fix invalid access in lpFind on corrupted listpack (#9819)
Issue found by corrupt-dump-fuzzer test with ASAN.
The problem was that lpSkip and lpGetWithSize could read the next listpack entry without validating that it's in range.
Similarly even the memcmp in lpFind could do that and possibly crash on segfault and now they'll crash on assert first.
The naive fix of using lpAssertValidEntry every time, resulted in 30% degradation in the lpFind benchmark of the unit test.
The final fix with the condition at the bottom has no performance implications.
Diffstat (limited to 'tests/modules')
0 files changed, 0 insertions, 0 deletions