scripting: no eval with negative key count

Negative key count causes segfault in Lua functions. Fixes redis#1842 Closes redis#1843
mattsta · Aug 2, 2014 · 7da1992 · 7da1992
1 parent f62cb0e
commit 7da1992
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 0 deletions.
diff --git a/src/scripting.c b/src/scripting.c
@@ -910,6 +910,9 @@ void evalGenericCommand(redisClient *c, int evalsha) {
     if (numkeys > (c->argc - 3)) {
         addReplyError(c,"Number of keys can't be greater than number of args");
         return;
+    } else if (numkeys < 0) {
+        addReplyError(c,"Number of keys can't be negative");
+        return;
     }
 
     /* We obtain the script SHA1, then check if this function is already

diff --git a/tests/unit/scripting.tcl b/tests/unit/scripting.tcl
@@ -358,6 +358,11 @@ start_server {tags {"scripting"}} {
             return redis.call("get", "key")
         } 0
     } {12039611435714932082}
+
+    test {Verify negative arg count is error instead of crash (issue #1842)} {
+        catch { r eval { return "hello" } -12 } e
+        set e
+    } {ERR Number of keys can't be negative}
 }
 
 # Start a new server since the last test in this stanza will kill the