From 2f8476df9124dfbd298a7ecce87870d44bdbb172 Mon Sep 17 00:00:00 2001 From: antirez Date: Fri, 12 Jan 2018 11:21:10 +0100 Subject: [PATCH] Fix getKeysUsingCommandTable() in the case of nagative arity. This fixes a crash with Redis Cluster when OBJECT is mis-used, because getKeysUsingCommandTable() will call serverPanic() detecting we are accessing an invalid argument in the case "OBJECT foo" is called. This bug was introduced when OBJECT HELP was introduced, because the key argument is set fixed at index 2 in the command table, however now OBJECT may be called with an insufficient number of arguments to extract the key. The "Right Thing" would be to have a specific function to extract keys from the OBJECT command, however this is kinda of an overkill, so I preferred to make getKeysUsingCommandTable() more robust and just return no keys when it's not possible to honor the command table, because new commands are often added and also there are a number with an HELP subcommand violating the normal form, and crashing for this trivial reason or having many command-specific key extraction functions is not great. --- src/db.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/src/db.c b/src/db.c index 0ded5558..203b2984 100644 --- a/src/db.c +++ b/src/db.c @@ -1152,11 +1152,13 @@ int *getKeysUsingCommandTable(struct redisCommand *cmd,robj **argv, int argc, in keys = zmalloc(sizeof(int)*((last - cmd->firstkey)+1)); for (j = cmd->firstkey; j <= last; j += cmd->keystep) { if (j >= argc) { - /* Modules command do not have dispatch time arity checks, so - * we need to handle the case where the user passed an invalid - * number of arguments here. In this case we return no keys - * and expect the module command to report an arity error. */ - if (cmd->flags & CMD_MODULE) { + /* Modules commands, and standard commands with a not fixed number + * of arugments (negative arity parameter) do not have dispatch + * time arity checks, so we need to handle the case where the user + * passed an invalid number of arguments here. In this case we + * return no keys and expect the command implementation to report + * an arity or syntax error. */ + if (cmd->flags & CMD_MODULE || cmd->arity < 0) { zfree(keys); *numkeys = 0; return NULL;