"GETRANGE" & "SETRANGE" SEGFAULT

[lemook]

Ubuntu redis 2.8.4.

Seems to be a key length check fail. may leak contiguous keys. Key needs to be a certain size before "GETRANGE" is called. Post-mortem routine doesn't seem to complete (could be local resource issue).

Example:

set ts "00351701411834604692317316873037158841057290043003500430043003500350004300350043003500430043-800035004317014118346046923173168730371588410572965536327260043003500350043004300350035004300430043--32769004300439100351004300350043003500350035004300430035004365535004300350043004300350035003500430043004300430035003500350035004300430035004300350043003529200350035003510043171682612607010043003500350035003500430043004300430035003500430043010043129004300430035191284609150043004300430043004317014118346046923173168730371588410572842949673320043004300430043003542949672620043004300035003500430035004300350035003500430035184467440737095516170035100430043003500430043004300431846867804328831374500430043004300432550035004300430043--327680035327320043-20043004300430035340282366920938463463374607431768211457004300350035004300430043004300430043-2560043003500430035547801539746572457217068937993881-80043004300350043004300350035003500430035004300350043004350043003500350043003500350035000350043003500431003"
GETRANGE ts 0 4294967297

edit:

looks like "SETRANGE" is also affected:
set key10 "1234559"
SETRANGE key10 9223372036854775803 Redis

[badboy]

setrange returns "ERR string exceeds maximum allowed size (512MB)" for me, as it has the explicit size check. The docu explicitely tells this:

Note that the maximum offset that you can set is 229 -1 (536870911), as Redis Strings are limited to 512 megabytes. If you need to grow beyond this size, you can use multiple keys.

getrange segfaults for me even with a small string. The docu says it should handle it properly:

The function handles out of range requests by limiting the resulting range to the actual length of the string.

It fails at this check: https://github.com/antirez/redis/blob/unstable/src/t_string.c#L258
Removing the (unsigned) casting (or replacing it with (size_t) let's the check succeed and getrange work properly (sizeof(unsigned) == sizeof(int) == 4, sizeof(long)==sizeof(size_t)==8).

[mattsta]

Fixed by #1847 and f62cb0e