Commit0719c1e

authored

Fix LZF decompression logic. (#2065)

* Fix LZF decompression logic.Rework how we decompress LZF data. Previously it was possible toencounter a double-free, if the error was not E2BIG.* .

1 parent56633e1 commit0719c1eCopy full SHA for 0719c1e

File tree

+16

-13

lines changed

+16

-13

lines changed

Lines changed: 8 additions & 13 deletions

Original file line number	Diff line number	Diff line change
`@@ -3030,27 +3030,22 @@ redis_uncompress(RedisSock redis_sock, char dst, size_t dstlen, const char *`
`3030`	`3030`	`caseREDIS_COMPRESSION_LZF:`
`3031`	`3031`	`#ifdefHAVE_REDIS_LZF`
`3032`	`3032`	`{`
`3033`		`-char*data;`
`3034`		`-inti;`
	`3033`	`+char*data=NULL;`
`3035`	`3034`	`uint32_tres;`
	`3035`	`+inti;`
`3036`	`3036`
`3037`	`3037`	`if (len==0)`
`3038`	`3038`	`break;`
`3039`	`3039`
`3040`		`-/* start from two-times bigger buffer and`
`3041`		`- * increase it exponentially if needed */`
	`3040`	`+/* Grow our buffer until we succeed or get a non E2BIG error */`
`3042`	`3041`	`errno=E2BIG;`
`3043`	`3042`	`for (i=2;errno==E2BIG;i *=2) {`
`3044`		`-data=emalloc(i*len);`
`3045`		`-if ((res=lzf_decompress(src,len,data,i*len))==0) {`
`3046`		`-/* errno != E2BIG will brake for loop */`
`3047`		`-efree(data);`
`3048`		`-continue;`
	`3043`	`+data=erealloc(data,len*i);`
	`3044`	`+if ((res=lzf_decompress(src,len,data,len*i))>0) {`
	`3045`	`+*dst=data;`
	`3046`	`+*dstlen=res;`
	`3047`	`+return1;`
`3049`	`3048`	`}`
`3050`		`-`
`3051`		`-*dst=data;`
`3052`		`-*dstlen=res;`
`3053`		`-return1;`
`3054`	`3049`	`}`
`3055`	`3050`
`3056`	`3051`	`efree(data);`

Lines changed: 8 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -4730,6 +4730,14 @@ public function testCompressionLZF()`
`4730`	`4730`	`if (!defined('Redis::COMPRESSION_LZF')) {`
`4731`	`4731`	`$this->markTestSkipped();`
`4732`	`4732`	`}`
	`4733`	`+`
	`4734`	`+/* Don't crash on improperly compressed LZF data */`
	`4735`	`+$payload ='not-actually-lzf-compressed';`
	`4736`	`+$this->redis->set('badlzf',$payload);`
	`4737`	`+$this->redis->setOption(Redis::OPT_COMPRESSION, Redis::COMPRESSION_LZF);`
	`4738`	`+$this->assertEquals($payload,$this->redis->get('badlzf'));`
	`4739`	`+$this->redis->setOption(Redis::OPT_COMPRESSION, Redis::COMPRESSION_NONE);`
	`4740`	`+`
`4733`	`4741`	`$this->checkCompression(Redis::COMPRESSION_LZF,0);`
`4734`	`4742`	`}`
`4735`	`4743`

Comments

(0)