[CRASH] crash in srandmember #632
Description
Reproduce
sadd myset a a b
srandmember myset -9223372036854775808
Crash log
# === ASSERTION FAILED ===
# ==> networking.cpp:917 'length >= 0' is not true
------ STACK TRACE ------
Backtrace:
keydb-server *:6379(addReplyAggregateLen(client*, long, int)+0x30) [0x5555556b6e60]
keydb-server *:6379(srandmemberWithCountCommand(client*)+0x17f) [0x5555556cc10f]
keydb-server *:6379(srandmemberCommand(client*)+0xe5) [0x5555556cc515]
keydb-server *:6379(call(client*, int)+0xb1) [0x555555767ae1]
keydb-server *:6379(processCommand(client*, int)+0x954) [0x555555768c64]
keydb-server *:6379(processCommandAndResetClient(client*, int)+0x66) [0x5555556afef6]
keydb-server *:6379(processInputBuffer(client*, bool, int)+0x174) [0x5555556b6084]
keydb-server *:6379(processClients()+0xd9) [0x5555556b6219]
keydb-server *:6379(+0x19ab62) [0x5555556eeb62]
keydb-server *:6379(beforeSleep(aeEventLoop*)+0x160) [0x55555569b330]
keydb-server *:6379(aeProcessEvents+0x10b) [0x555555695b0b]
keydb-server *:6379(aeMain+0x47) [0x55555569c4e7]
keydb-server *:6379(workerThreadMain(void*)+0x73) [0x55555576a5b3]
/lib/x86_64-linux-gnu/libpthread.so.0(+0x76db) [0x7ffff5c4b6db]
/lib/x86_64-linux-gnu/libc.so.6(clone+0x3f) [0x7ffff597461f]
Aditional information
- The crash can be reproduced on the keydb 6.3.2 docker image.
- This bug shares a similar root cause with the zrandmember crash.
- A similar crash was also found in redis and has already been patched. The related PR commit can be found at Integer Overflow in RAND commands can lead to assertion (CVE-2023-25155) redis/redis#11857, which might help with implementing the fix for keydb.
Thanks.