Replace all usage of ziplist with listpack for t_hash

src/listpack.c

@@ -949,15 +949,17 @@ unsigned char *lpAppendInteger(unsigned char *lp, long long lval) {
     return lpInsertInteger(lp, lval, eofptr, LP_BEFORE, NULL);
 }
 
-/* Remove the element pointed by 'p'. */
+/* This is just a wrapper for lpInsert() to directly use a string to replace
+ * the current element. The function returns the new listpack as return
+ * value, and also updates the current cursor by updating '*p'. */
 unsigned char *lpReplace(unsigned char *lp, unsigned char **p, unsigned char *s, uint32_t slen) {
     return lpInsert(lp, s, NULL, slen, *p, LP_REPLACE, p);
 }
 
 /* This is just a wrapper for lpInsertInteger() to directly use a 64 bit integer
  * instead of a string to replace the current element. The function returns
  * the new listpack as return value, and also updates the current cursor
- * by updating '*pos'. */
+ * by updating '*p'. */
 unsigned char *lpReplaceInteger(unsigned char *lp, unsigned char **p, long long lval) {
     return lpInsertInteger(lp, lval, *p, LP_REPLACE, p);
 }
@@ -1114,8 +1116,8 @@ int lpValidateIntegrity(unsigned char *lp, size_t size, int deep,
     while(p && p[0] != LP_EOF) {
         unsigned char *prev = p;
 
-        /* Move to the next entry in advance to avoid crash
-         * due to corrupt listpack. */
+        /* Validate this entry and move to the next entry in advance
+         * to avoid callback crash due to corrupt listpack. */
         if (!lpValidateNext(lp, &p, bytes))
             return 0;
 

src/ziplist.c

@@ -1527,7 +1527,7 @@ int ziplistValidateIntegrity(unsigned char *zl, size_t size, int deep,
         return 0;
 
     /* Make sure the <zltail> entry really do point to the start of the last entry. */
-    if (prev != ZIPLIST_ENTRY_TAIL(zl))
+    if (prev != NULL && prev != ZIPLIST_ENTRY_TAIL(zl))
         return 0;
 
     /* Check that the count in the header is correct */

tests/integration/corrupt-dump.tcl

@@ -670,5 +670,15 @@ test {corrupt payload: fuzzer findings - hash with len of 0} {
     }
 }
 
+test {corrupt payload: fuzzer findings - hash listpack first element too long entry len} {
+    start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
+        r debug set-skip-checksum-validation 1
+        r config set sanitize-dump-payload yes
+        catch { r restore _hash 0 "\x10\x15\x15\x00\x00\x00\x06\x00\xF0\x01\x00\x01\x01\x01\x82\x5F\x31\x03\x02\x01\x02\x01\xFF\x0A\x00\x94\x21\x0A\xFA\x06\x52\x9F\x44" replace } err
+        assert_match "*Bad data format*" $err
+        verify_log_message 0 "*integrity check failed*" 0
+    }
+}
+
 } ;# tags