Avoid an out-of-bounds read in the redis-sentinel (#7443)
The Redis sentinel would crash with a segfault after a few minutes
because it tried to read from a page without read permissions. Check up
front whether the sds is long enough to contain redis:slave or
redis:master before memcmp() as is done everywhere else in
sentinelRefreshInstanceInfo().
Bug report and commit message from Theo Buehler. Fix from Nam Nguyen.
Co-authored-by: Nam Nguyen <namn@berkeley.edu>
(cherry picked from commit 63dae52324)
This commit is contained in:
1 parent
b2bd3c0653
commit
2bcc056a41
1 file changed
+2
-2
+2
-2
@@ -2218,8 +2218,8 @@ void sentinelRefreshInstanceInfo(sentinelRedisInstance *ri, const char *info) {
|
||||
}
|
||||
|
||||
/* role:<role> */
|
||||
if (!memcmp(l,"role:master",11)) role = SRI_MASTER;
|
||||
else if (!memcmp(l,"role:slave",10)) role = SRI_SLAVE;
|
||||
if (sdslen(l) >= 11 && !memcmp(l,"role:master",11)) role = SRI_MASTER;
|
||||
else if (sdslen(l) >= 10 && !memcmp(l,"role:slave",10)) role = SRI_SLAVE;
|
||||
|
||||
if (role == SRI_SLAVE) {
|
||||
/* master_host:<host> */
|
||||
|
||||
Reference in new issue
Block a user