Avoid an out-of-bounds read in the redis-sentinel

The Redis sentinel would crash with a segfault after a few minutes because
it tried to read from a page without read permissions. Check up front
whether the sds is long enough to contain redis:slave or redis:master
before memcmp() as is done everywhere else in sentinelRefreshInstanceInfo().

From Nam Nguyen
This commit is contained in:
tb 2020-06-28 10:47:15 +00:00
parent 927dec0a23
commit b8bb52ab64
2 changed files with 20 additions and 1 deletions

View File

@ -1,9 +1,10 @@
# $OpenBSD: Makefile,v 1.113 2020/06/14 07:35:36 tb Exp $
# $OpenBSD: Makefile,v 1.114 2020/06/28 10:47:15 tb Exp $
COMMENT = persistent key-value database
DISTNAME = redis-6.0.5
CATEGORIES = databases
HOMEPAGE = https://redis.io/
REVISION = 0
# BSD
PERMIT_PACKAGE = Yes

View File

@ -0,0 +1,18 @@
$OpenBSD: patch-src_sentinel_c,v 1.1 2020/06/28 10:47:15 tb Exp $
redis-sentinel out of bounds memory access from memcmp
Index: src/sentinel.c
--- src/sentinel.c.orig
+++ src/sentinel.c
@@ -2217,8 +2217,8 @@ void sentinelRefreshInstanceInfo(sentinelRedisInstance
}
/* role:<role> */
- if (!memcmp(l,"role:master",11)) role = SRI_MASTER;
- else if (!memcmp(l,"role:slave",10)) role = SRI_SLAVE;
+ if (sdslen(l) >= 11 && !memcmp(l,"role:master",11)) role = SRI_MASTER;
+ else if (sdslen(l) >= 10 && !memcmp(l,"role:slave",10)) role = SRI_SLAVE;
if (role == SRI_SLAVE) {
/* master_host:<host> */