From 16f408b1a0121cacd44cbf8aee275d69dc627f02 Mon Sep 17 00:00:00 2001
From: Oran Agra <oran@redislabs.com>
Date: Mon, 16 Jan 2023 13:50:27 +0200
Subject: Fix range issues in ZRANDMEMBER and HRANDFIELD (CVE-2023-22458)
 (#11674)

missing range check in ZRANDMEMBER and HRANDIFLD leading to panic due
to protocol limitations
---
 tests/unit/type/hash.tcl | 5 +++++
 tests/unit/type/zset.tcl | 5 +++++
 2 files changed, 10 insertions(+)

(limited to 'tests')

diff --git a/tests/unit/type/hash.tcl b/tests/unit/type/hash.tcl
index e7b9f3d85..113780ff7 100644
--- a/tests/unit/type/hash.tcl
+++ b/tests/unit/type/hash.tcl
@@ -71,6 +71,11 @@ start_server {tags {"hash"}} {
         r hrandfield myhash 0
     } {}
 
+    test "HRANDFIELD count overflow" {
+        r hmset myhash a 1
+        assert_error {*value is out of range*} {r hrandfield myhash -9223372036854770000 withvalues}
+    } {}
+
     test "HRANDFIELD with <count> against non existing key" {
         r hrandfield nonexisting_key 100
     } {}
diff --git a/tests/unit/type/zset.tcl b/tests/unit/type/zset.tcl
index 41898f27b..036638510 100644
--- a/tests/unit/type/zset.tcl
+++ b/tests/unit/type/zset.tcl
@@ -2322,6 +2322,11 @@ start_server {tags {"zset"}} {
         r zrandmember nonexisting_key 100
     } {}
 
+    test "ZRANDMEMBER count overflow" {
+        r zadd myzset 0 a
+        assert_error {*value is out of range*} {r zrandmember myzset -9223372036854770000 withscores}
+    } {}
+
     # Make sure we can distinguish between an empty array and a null response
     r readraw 1
 
-- 
cgit v1.2.1