Fix infinite loop during reverse iteration due to invalid numfields of corrupted stream#14472
Merged
sundb merged 1 commit intoredis:unstablefrom Jan 5, 2026
Merged
Fix infinite loop during reverse iteration due to invalid numfields of corrupted stream#14472sundb merged 1 commit intoredis:unstablefrom
sundb merged 1 commit intoredis:unstablefrom
Conversation
…f corrupted stream
sggeorgiev
reviewed
Jan 5, 2026
| /* Record the previous lp_ele position to detect data corruption | ||
| * that might cause the iterator to move backwards unexpectedly. */ | ||
| if (si->lp_ele && si->lp_last_ele) | ||
| serverAssert(si->rev ? si->lp_ele < si->lp_last_ele : si->lp_ele > si->lp_last_ele); |
Collaborator
There was a problem hiding this comment.
Do we have guarantee that address in pointers are in increasing order in the list?
Collaborator
Author
There was a problem hiding this comment.
Yes, otherwise this iterator would eventually end up in an infinite loop, constantly going back and forth.
ShooterIT
approved these changes
Jan 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow #14423
In #14423,
I thought the last lpNext operation of the iterator occurred at the end of streamIteratorGetID.
However, I overlooked the fact that after calling
streamIteratorGetID(), we might still usestreamIteratorGetField()to continue moving within the current entry.This means that during reverse iteration, the iterator could move back to a previous entry position.
To fix this, in this PR I record the current position at the beginning of streamIteratorGetID().
When we enter it again next time, we ensure that the entry position does not exceed the previous one,
that is, during forward iteration the entry must be greater than the last entry position,
and during reverse iteration it must be smaller than the last entry position.
Note that the fix for #14423 has been replaced by this fix.