Avoid an out-of-bounds read in the redis-sentinel
The Redis sentinel would crash with a segfault after a few minutes because it tried to read from a page without read permissions. Check up front whether the sds is long enough to contain redis:slave or redis:master before memcmp() as is done everywhere else in sentinelRefreshInstanceInfo(). From Nam Nguyen
This commit is contained in:
parent
927dec0a23
commit
b8bb52ab64
@ -1,9 +1,10 @@
|
||||
# $OpenBSD: Makefile,v 1.113 2020/06/14 07:35:36 tb Exp $
|
||||
# $OpenBSD: Makefile,v 1.114 2020/06/28 10:47:15 tb Exp $
|
||||
|
||||
COMMENT = persistent key-value database
|
||||
DISTNAME = redis-6.0.5
|
||||
CATEGORIES = databases
|
||||
HOMEPAGE = https://redis.io/
|
||||
REVISION = 0
|
||||
|
||||
# BSD
|
||||
PERMIT_PACKAGE = Yes
|
||||
|
18
databases/redis/patches/patch-src_sentinel_c
Normal file
18
databases/redis/patches/patch-src_sentinel_c
Normal file
@ -0,0 +1,18 @@
|
||||
$OpenBSD: patch-src_sentinel_c,v 1.1 2020/06/28 10:47:15 tb Exp $
|
||||
|
||||
redis-sentinel out of bounds memory access from memcmp
|
||||
|
||||
Index: src/sentinel.c
|
||||
--- src/sentinel.c.orig
|
||||
+++ src/sentinel.c
|
||||
@@ -2217,8 +2217,8 @@ void sentinelRefreshInstanceInfo(sentinelRedisInstance
|
||||
}
|
||||
|
||||
/* role:<role> */
|
||||
- if (!memcmp(l,"role:master",11)) role = SRI_MASTER;
|
||||
- else if (!memcmp(l,"role:slave",10)) role = SRI_SLAVE;
|
||||
+ if (sdslen(l) >= 11 && !memcmp(l,"role:master",11)) role = SRI_MASTER;
|
||||
+ else if (sdslen(l) >= 10 && !memcmp(l,"role:slave",10)) role = SRI_SLAVE;
|
||||
|
||||
if (role == SRI_SLAVE) {
|
||||
/* master_host:<host> */
|
Loading…
x
Reference in New Issue
Block a user