Skip to content

Conversation

@enjoy-binbin
Copy link
Contributor

The following error commands will crash redis-server:

> get|
Error: Server closed the connection
> get|set
Error: Server closed the connection
> get|other

The reason is in #9504, we use lookupCommandBySds for find the
container command. And it split the command (argv[0]) with |.
If we input something like get|other, after the split, get
will become a valid command name, pass the ERR unknown command
check, and finally crash in addReplySubcommandSyntaxError

In this case we do not need to split the command name with |
and just look in the commands dict to find if argv[0] is a
container command.

So this commit introduce a new function call isContainerCommandBySds
that it will return true if a command name is a container command.

Also with the old code, there is a incorrect error message:

> config|get set
(error) ERR Unknown subcommand or wrong number of arguments for 'set'. Try CONFIG|GET HELP.

The crash was reported in #10070.

The following error commands will crash redis-server:
```
> get|
Error: Server closed the connection
> get|set
Error: Server closed the connection
> get|other
```

The reason is in redis#9504, we use `lookupCommandBySds` for find the
container command. And it split the command (argv[0]) with `|`.
If we input something like `get|other`, after the split, `get`
will become a valid command name, pass the `ERR unknown command`
check, and finally crash in `addReplySubcommandSyntaxError`

In this case we do not need to split the command name with `|`
and just look in the commands dict to find if `argv[0]` is a
container command.

So this commit introduce a new function call `isContainerCommandBySds`
that it will return true if a command name is a container command.

Also with the old code, there is a incorrect error message:
```
> config|get set
(error) ERR Unknown subcommand or wrong number of arguments for 'set'. Try CONFIG|GET HELP.
```

The crash was reported in redis#10070.
@enjoy-binbin enjoy-binbin requested a review from oranagra January 9, 2022 09:40
@oranagra oranagra linked an issue Jan 9, 2022 that may be closed by this pull request
@oranagra oranagra merged commit a84c964 into redis:unstable Jan 9, 2022
@enjoy-binbin enjoy-binbin deleted the fix_subcommand_syntax_crash branch January 9, 2022 11:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Archived in project

Development

Successfully merging this pull request may close these issues.

[CRASH] SIGSEGV in addReplySubcommandSyntaxError at networking.c:966

2 participants