From c8b4b81a9c669a383ecf7096c72401dea7b94b49 Mon Sep 17 00:00:00 2001 From: Sergei Georgiev Date: Thu, 27 Nov 2025 11:41:11 +0200 Subject: [PATCH] Invalid Memory Access in Redis RESTORE Command (CVE-2026-25243) --- src/rdb.c | 6 +-- src/sds.c | 9 +++- src/zipmap.c | 7 +++ tests/integration/corrupt-dump.tcl | 82 ++++++++++++++++++++++++++++++ tests/unit/dump.tcl | 15 ++++++ 5 files changed, 115 insertions(+), 4 deletions(-) Index: b/src/rdb.c =================================================================== --- a/src/rdb.c +++ b/src/rdb.c @@ -2148,11 +2148,12 @@ robj *rdbLoadObject(int rdbtype, rio *rd /* search for duplicate records */ sds field = sdstrynewlen(fstr, flen); - if (!field || dictAdd(dupSearchDict, field, NULL) != DICT_OK || - !lpSafeToAdd(lp, (size_t)flen + vlen)) { + if (!field || !lpSafeToAdd(lp, (size_t)flen + vlen) || + dictAdd(dupSearchDict, field, NULL) != DICT_OK) { rdbReportCorruptRDB("Hash zipmap with dup elements, or big length (%u)", flen); dictRelease(dupSearchDict); sdsfree(field); + lpFree(lp); zfree(encoded); o->ptr = NULL; decrRefCount(o); @@ -2584,7 +2585,6 @@ robj *rdbLoadObject(int rdbtype, rio *rd " loading a stream consumer " "group"); decrRefCount(o); - streamFreeNACK(nack); return NULL; } } Index: b/src/sds.c =================================================================== --- a/src/sds.c +++ b/src/sds.c @@ -111,7 +111,14 @@ sds _sdsnewlen(const void *init, size_t unsigned char *fp; /* flags pointer. */ size_t usable; - assert(initlen + hdrlen + 1 > initlen); /* Catch size_t overflow */ + if (trymalloc) { + /* protect against size_t overflow */ + if (initlen + hdrlen + 1 <= initlen) + return NULL; + } else { + assert(initlen + hdrlen + 1 > initlen); /* Catch size_t overflow */ + } + sh = trymalloc? s_trymalloc_usable(hdrlen+initlen+1, &usable) : s_malloc_usable(hdrlen+initlen+1, &usable); Index: b/src/zipmap.c =================================================================== --- a/src/zipmap.c +++ b/src/zipmap.c @@ -405,6 +405,10 @@ int zipmapValidateIntegrity(unsigned cha /* read the field name length */ l = zipmapDecodeLength(p); + /* Sanity check: length < 254 must be encoded in 1 byte, not 5 bytes */ + if (l < ZIPMAP_BIGLEN && s != 1) + return 0; + p += s; /* skip the encoded field size */ p += l; /* skip the field */ @@ -420,6 +424,9 @@ int zipmapValidateIntegrity(unsigned cha /* read the value length */ l = zipmapDecodeLength(p); + /* Sanity check: length < 254 must be encoded in 1 byte, not 5 bytes */ + if (l < ZIPMAP_BIGLEN && s != 1) + return 0; p += s; /* skip the encoded value size*/ e = *p++; /* skip the encoded free space (always encoded in one byte) */ p += l+e; /* skip the value and free space */ Index: b/tests/integration/corrupt-dump.tcl =================================================================== --- a/tests/integration/corrupt-dump.tcl +++ b/tests/integration/corrupt-dump.tcl @@ -790,5 +790,88 @@ test {corrupt payload: fuzzer findings - } } +test {corrupt payload: zipmap - element wouldn't fit in listpack} { + # Redis converts legacy zipmap encoded hashes to listpacks. + # This test creates a zipmap entry with a 1GB value which cannot + # fit into a listpack and verifies that RESTORE fails. + + start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no proto-max-bulk-len 2147483648 client-query-buffer-limit 2147483648]] { + proc zipmap_encode_len {len} { + if {$len < 254} { + return [binary format c $len] + } else { + return [binary format ci 254 $len] + } + } + r config set sanitize-dump-payload no + + # Generates Zipmap with 1GB value - should fail lpSafeToAdd check + set val_len [expr {1024 * 1024 * 1024 + 1}] + + # Zipmap has 1 element + set zm [binary format c 1] + # Field is 1 byte long + append zm [zipmap_encode_len 1] + append zm "k" + # Value is 1GB long + append zm [zipmap_encode_len $val_len] + append zm [binary format c 0] + append zm [string repeat "A" $val_len] + # ZIPMAP_END marker + append zm [binary format c 255] + # Prepend RDB header + set zm_len [string length $zm] + set rdb_len [binary format cI 0x80 $zm_len] + set dump [binary format c 9] + append dump $rdb_len + append dump $zm + append dump [binary format s 9] + append dump [binary format w 0] + + catch {r RESTORE _hash 0 $dump} err + assert_match "*Bad data format*" $err + } +} {} {large-memory} + +test {corrupt payload: zipmap - 5 bytes length encoding for a small field} { + start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no]] { + catch { + r restore key 0 "\x09\x11\x01\xfe\x04\x00\x00\x00\x01\x00\xff\x00\x04\x00\x76\x61\x6c\x31\xff\x09\x00\xf9\xd5\xa4\xf7\x7d\x00\x3f\x1b" + } err + assert_match "*Bad data format*" $err + verify_log_message 0 "*integrity check failed*" 0 + } +} + +test {corrupt payload: zipmap - 5 bytes length encoding for a small value} { + start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no]] { + catch { + r restore key 0 "\x09\x0e\x01\x01\x6b\xfe\x04\x00\x00\x00\x00\x76\x61\x6c\x31\xff\x09\x00\xd0\xf9\xe4\x1d\xe4\xfb\x11\x4c" + } err + assert_match "*Bad data format*" $err + verify_log_message 0 "*integrity check failed*" 0 + } +} + +test {corrupt payload: zipmap - 5 bytes length encoding and a huge field} { + start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] { + catch { + r restore key 0 "\x09\x41\x15\x02\x04\x6b\x65\x79\x31\x04\x00\x76\x61\x6c\x31\xfe\x04\x00\x00\x00\xfe\xff\xff\xff\xfd\x00\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\xff\x09\x00\x54\x2f\x0a\xca\x4e\x5c\x49\x9f" + } err + assert_match "*Bad data format*" $err + verify_log_message 0 "*integrity check failed*" 0 + } +} + +test {corrupt payload: stream - duplicated consumer PEL entry} { + start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] { + r debug set-skip-checksum-validation 1 + catch { + r restore k 0 "\x0f\x01\x10\x00\x00\x01\x9b\x73\x06\x3b\xed\x00\x00\x00\x00\x00\x00\x00\x00\x28\x28\x00\x00\x00\x0f\x00\x02\x01\x00\x01\x01\x01\x81\x66\x02\x00\x01\x02\x01\x00\x01\x00\x01\x81\x76\x02\x04\x01\x02\x01\x00\x01\x01\x01\x81\x76\x02\x04\x01\xff\x02\x81\x00\x00\x01\x9b\x73\x06\x3b\xed\x01\x01\x01\x67\x81\x00\x00\x01\x9b\x73\x06\x3b\xed\x01\x02\x00\x00\x01\x9b\x73\x06\x3b\xed\x00\x00\x00\x00\x00\x00\x00\x00\xee\x3b\x06\x73\x9b\x01\x00\x00\x01\x00\x00\x01\x9b\x73\x06\x3b\xed\x00\x00\x00\x00\x00\x00\x00\x01\xee\x3b\x06\x73\x9b\x01\x00\x00\x01\x01\x01\x63\xee\x3b\x06\x73\x9b\x01\x00\x00\x02\x00\x00\x01\x9b\x73\x06\x3b\xed\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x9b\x73\x06\x3b\xed\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x59\xa9\xd3\x45\x4d\xc3\x9a\x5b" REPLACE + } err + assert_match "*Bad data format*" $err + verify_log_message 0 "*Duplicated consumer PEL entry*" 0 + } +} } ;# tags Index: b/tests/unit/dump.tcl =================================================================== --- a/tests/unit/dump.tcl +++ b/tests/unit/dump.tcl @@ -96,6 +96,21 @@ start_server {tags {"dump"}} { set e } {*syntax*} + test {RESTORE fail with invalid payload size} { + r debug set-skip-checksum-validation 1 + # Payload with mismatched size: claims 0xFFFFFFFFFFFFFFF7 bytes (max uint64 - 8) but provides no data + # \x00 = String type + # \x81 = 64-bit length marker + # \xFF\xFF\xFF\xFF\xFF\xFF\xFF\xF7 = 18446744073709551607 in big-endian + # \x0c\x00 = RDB version + # \x00... = fake CRC64 + set encoded "\x00\x81\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xF7\x09\x00\x00\x00\x00\x00\x00\x00\x00\x00" + r del test + catch {r restore test 0 $encoded} e + r debug set-skip-checksum-validation 0 + set e + } {*Bad data format*} {needs:debug} + test {DUMP of non existing key returns nil} { r dump nonexisting_key } {}