Skip to content

Commit

Permalink
Fix integer overflow in STRALGO LCS (CVE-2021-29477)
Browse files Browse the repository at this point in the history
An integer overflow bug in Redis version 6.0 or newer could be exploited using
the STRALGO LCS command to corrupt the heap and potentially result with remote
code execution.

(cherry picked from commit f0c5f92)
  • Loading branch information
oranagra committed May 3, 2021
1 parent 789f101 commit 394614a
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion src/t_string.c
Expand Up @@ -576,7 +576,7 @@ void stralgoLCS(client *c) {
/* Setup an uint32_t array to store at LCS[i,j] the length of the
* LCS A0..i-1, B0..j-1. Note that we have a linear array here, so
* we index it as LCS[j+(blen+1)*j] */
uint32_t *lcs = zmalloc((alen+1)*(blen+1)*sizeof(uint32_t));
uint32_t *lcs = zmalloc((size_t)(alen+1)*(blen+1)*sizeof(uint32_t));
#define LCS(A,B) lcs[(B)+((A)*(blen+1))]

/* Start building the LCS table. */
Expand Down

0 comments on commit 394614a

Please sign in to comment.