Skip to content

Commit c54e33f

Browse files
committed
bugfix: lua stack overflow would happen when too many redis arguments were passed into the build_query method. thanks Guo Yin for reporting this issue.
1 parent 0258b9e commit c54e33f

File tree

2 files changed

+11
-4
lines changed

2 files changed

+11
-4
lines changed

redis-parser.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -590,6 +590,8 @@ redis_build_query(lua_State *L)
590590
return luaL_error(L, "parameter %d is not a string, number, "
591591
"redis.parser.null, or boolean value", i);
592592
}
593+
594+
lua_pop(L, 1);
593595
}
594596

595597
buf = lua_newuserdata(L, total); /* lua_newuserdata never returns NULL */
@@ -642,6 +644,8 @@ redis_build_query(lua_State *L)
642644
/* cannot reach here */
643645
break;
644646
}
647+
648+
lua_pop(L, 1);
645649
}
646650

647651
if (last - buf != (ssize_t) total) {

t/sanity.t

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -503,9 +503,12 @@ res == null\n}
503503
--- lua
504504
cjson = require('cjson')
505505
parser = require("redis.parser")
506-
q = {"a","a","a","a","a","a","a","a","a","a","a","a","a","a","a","a","a","a","a","a","a","a","a","a","a","a","a","a","a","a","a","a","a","a","a","a","a","a","a","a","a","a","a","a"}
506+
q = {}
507+
for i = 1,2048 do
508+
table.insert(q, "a")
509+
end
507510
local query = parser.build_query(q)
508-
print("query == " .. cjson.encode(query))
509-
--- out eval
510-
"query == \"*44\\r\\n" . ("\$1\\r\\na\\r\\n" x 44) . "\"\n"
511+
print(string.len(query))
512+
--- out
513+
14343
511514

0 commit comments

Comments
 (0)