|
 |
bc1a02 |
From 9f13b2bd4967334b1701c6eccdf53760cb13f79e Mon Sep 17 00:00:00 2001
|
|
|
bc1a02 |
From: John Sully <john@csquare.ca>
|
|
|
bc1a02 |
Date: Thu, 14 Mar 2019 14:02:16 -0400
|
|
|
bc1a02 |
Subject: [PATCH] Fix hyperloglog corruption
|
|
|
bc1a02 |
|
|
|
bc1a02 |
---
|
|
|
bc1a02 |
src/hyperloglog.c | 6 ++++++
|
|
|
bc1a02 |
1 file changed, 6 insertions(+)
|
|
|
bc1a02 |
|
|
|
bc1a02 |
diff --git a/src/hyperloglog.c b/src/hyperloglog.c
|
|
|
bc1a02 |
index fc21ea0065d..e993bf26e1d 100644
|
|
|
bc1a02 |
--- a/src/hyperloglog.c
|
|
|
bc1a02 |
+++ b/src/hyperloglog.c
|
|
|
bc1a02 |
@@ -614,6 +614,10 @@ int hllSparseToDense(robj *o) {
|
|
|
bc1a02 |
} else {
|
|
|
bc1a02 |
runlen = HLL_SPARSE_VAL_LEN(p);
|
|
|
bc1a02 |
regval = HLL_SPARSE_VAL_VALUE(p);
|
|
|
bc1a02 |
+ if ((runlen + idx) > HLL_REGISTERS) {
|
|
|
bc1a02 |
+ sdsfree(dense);
|
|
|
bc1a02 |
+ return C_ERR;
|
|
|
bc1a02 |
+ }
|
|
|
bc1a02 |
while(runlen--) {
|
|
|
bc1a02 |
HLL_DENSE_SET_REGISTER(hdr->registers,idx,regval);
|
|
|
bc1a02 |
idx++;
|
|
|
bc1a02 |
@@ -1088,6 +1092,8 @@ int hllMerge(uint8_t *max, robj *hll) {
|
|
|
bc1a02 |
} else {
|
|
|
bc1a02 |
runlen = HLL_SPARSE_VAL_LEN(p);
|
|
|
bc1a02 |
regval = HLL_SPARSE_VAL_VALUE(p);
|
|
|
bc1a02 |
+ if ((runlen + i) > HLL_REGISTERS)
|
|
|
bc1a02 |
+ return C_ERR;
|
|
|
bc1a02 |
while(runlen--) {
|
|
|
bc1a02 |
if (regval > max[i]) max[i] = regval;
|
|
|
bc1a02 |
i++;
|
|
|
bc1a02 |
From e216ceaf0e099536fe3658a29dcb725d812364e0 Mon Sep 17 00:00:00 2001
|
|
|
bc1a02 |
From: antirez <antirez@gmail.com>
|
|
|
bc1a02 |
Date: Fri, 15 Mar 2019 17:16:06 +0100
|
|
|
bc1a02 |
Subject: [PATCH] HyperLogLog: handle wrong offset in the base case.
|
|
|
bc1a02 |
|
|
|
bc1a02 |
---
|
|
|
bc1a02 |
src/hyperloglog.c | 8 ++------
|
|
|
bc1a02 |
1 file changed, 2 insertions(+), 6 deletions(-)
|
|
|
bc1a02 |
|
|
|
bc1a02 |
diff --git a/src/hyperloglog.c b/src/hyperloglog.c
|
|
|
bc1a02 |
index 526510b43b9..1e7ce3dceb7 100644
|
|
|
bc1a02 |
--- a/src/hyperloglog.c
|
|
|
bc1a02 |
+++ b/src/hyperloglog.c
|
|
|
bc1a02 |
@@ -614,10 +614,7 @@ int hllSparseToDense(robj *o) {
|
|
|
bc1a02 |
} else {
|
|
|
bc1a02 |
runlen = HLL_SPARSE_VAL_LEN(p);
|
|
|
bc1a02 |
regval = HLL_SPARSE_VAL_VALUE(p);
|
|
|
bc1a02 |
- if ((runlen + idx) > HLL_REGISTERS) {
|
|
|
bc1a02 |
- sdsfree(dense);
|
|
|
bc1a02 |
- return C_ERR;
|
|
|
bc1a02 |
- }
|
|
|
bc1a02 |
+ if ((runlen + idx) > HLL_REGISTERS) break; /* Overflow. */
|
|
|
bc1a02 |
while(runlen--) {
|
|
|
bc1a02 |
HLL_DENSE_SET_REGISTER(hdr->registers,idx,regval);
|
|
|
bc1a02 |
idx++;
|
|
|
bc1a02 |
@@ -1097,8 +1094,7 @@ int hllMerge(uint8_t *max, robj *hll) {
|
|
|
bc1a02 |
} else {
|
|
|
bc1a02 |
runlen = HLL_SPARSE_VAL_LEN(p);
|
|
|
bc1a02 |
regval = HLL_SPARSE_VAL_VALUE(p);
|
|
|
bc1a02 |
- if ((runlen + i) > HLL_REGISTERS)
|
|
|
bc1a02 |
- return C_ERR;
|
|
|
bc1a02 |
+ if ((runlen + i) > HLL_REGISTERS) break; /* Overflow. */
|
|
|
bc1a02 |
while(runlen--) {
|
|
|
bc1a02 |
if (regval > max[i]) max[i] = regval;
|
|
|
bc1a02 |
i++;
|
|
|
bc1a02 |
From 4208666797b5831eefc022ae46ab5747200cd671 Mon Sep 17 00:00:00 2001
|
|
|
bc1a02 |
From: antirez <antirez@gmail.com>
|
|
|
bc1a02 |
Date: Fri, 15 Mar 2019 13:52:29 +0100
|
|
|
bc1a02 |
Subject: [PATCH] HyperLogLog: dense/sparse repr parsing fuzz test.
|
|
|
bc1a02 |
|
|
|
bc1a02 |
---
|
|
|
bc1a02 |
tests/unit/hyperloglog.tcl | 29 +++++++++++++++++++++++++++++
|
|
|
bc1a02 |
1 file changed, 29 insertions(+)
|
|
|
bc1a02 |
|
|
|
bc1a02 |
diff --git a/tests/unit/hyperloglog.tcl b/tests/unit/hyperloglog.tcl
|
|
|
bc1a02 |
index 7d36b7a351f..6a9c47b11c5 100644
|
|
|
bc1a02 |
--- a/tests/unit/hyperloglog.tcl
|
|
|
bc1a02 |
+++ b/tests/unit/hyperloglog.tcl
|
|
|
bc1a02 |
@@ -115,6 +115,35 @@ start_server {tags {"hll"}} {
|
|
|
bc1a02 |
set e
|
|
|
bc1a02 |
} {*WRONGTYPE*}
|
|
|
bc1a02 |
|
|
|
bc1a02 |
+ test {Fuzzing dense/sparse encoding: Redis should always detect errors} {
|
|
|
bc1a02 |
+ for {set j 0} {$j < 10000} {incr j} {
|
|
|
bc1a02 |
+ r del hll
|
|
|
bc1a02 |
+ set items {}
|
|
|
bc1a02 |
+ set numitems [randomInt 3000]
|
|
|
bc1a02 |
+ for {set i 0} {$i < $numitems} {incr i} {
|
|
|
bc1a02 |
+ lappend items [expr {rand()}]
|
|
|
bc1a02 |
+ }
|
|
|
bc1a02 |
+ r pfadd hll {*}$items
|
|
|
bc1a02 |
+
|
|
|
bc1a02 |
+ # Corrupt it in some random way.
|
|
|
bc1a02 |
+ for {set i 0} {$i < 5} {incr i} {
|
|
|
bc1a02 |
+ set len [r strlen hll]
|
|
|
bc1a02 |
+ set pos [randomInt $len]
|
|
|
bc1a02 |
+ set byte [randstring 1 1 binary]
|
|
|
bc1a02 |
+ r setrange hll $pos $byte
|
|
|
bc1a02 |
+ # Don't modify more bytes 50% of times
|
|
|
bc1a02 |
+ if {rand() < 0.5} break
|
|
|
bc1a02 |
+ }
|
|
|
bc1a02 |
+
|
|
|
bc1a02 |
+ # Use the hyperloglog to check if it crashes
|
|
|
bc1a02 |
+ # Redis in some way.
|
|
|
bc1a02 |
+ catch {
|
|
|
bc1a02 |
+ r pfcount hll
|
|
|
bc1a02 |
+ r pfdebug getreg hll
|
|
|
bc1a02 |
+ }
|
|
|
bc1a02 |
+ }
|
|
|
bc1a02 |
+ }
|
|
|
bc1a02 |
+
|
|
|
bc1a02 |
test {PFADD, PFCOUNT, PFMERGE type checking works} {
|
|
|
bc1a02 |
r set foo bar
|
|
|
bc1a02 |
catch {r pfadd foo 1} e
|