valkey-io/valkey

[BUG] A large negative number(e.g. -LONG_MAX) in HRANDFIELD/ZRANDMEMBER can easily cause Valkey to crash.

Open

#844 opened on Jul 30, 2024

View on GitHubContributor guide
 (18 comments) (1 reaction) (1 assignee)C (1,138 forks)batch import
good first issuehelp wanted

Repository metrics

Stars
 (25,779 stars)
PR merge metrics
 (Avg merge 17d 7h) (74 merged PRs in 30d)

Description

Describe the bug

When using the HRANDFIELD or ZRANDMEMBER commands, if an extremely negative value(e.g. -LONG_MAX) is provided, the memory will continue to rise and eventually cause Redis to crash.

To reproduce

HRANDFIELD hash -9223372036854775807

Expected behavior

IMHO, it is more reasonable to set a limit on count according to the memory limit or the actual size of the hash table to prevent Redis from crashing. This can prevent crashes caused by careless and incorrect use. If a user really needs to sample a lot of elements that allow duplicates, he can achieve the same purpose by calling the command multiple times.

Contributor guide

Research direction
Inspect the implementation of HRANDFIELD and ZRANDMEMBER in the source code, trace how the count argument is processed, and identify where the negative value causes unbounded memory allocation. Add a check to cap the absolute value of count to a safe limit based on the hash/set size or a global maximum.
Tech stack
c
Domain
backenddatabase
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
C
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
65