Skip to content

Commit 7bb7b7f

Browse files
authored
Out of Bounds read in valkey-benchmark (#4142)
Running: ```sh ./valkey-benchmark -t get 10000 ``` causes `valkey-benchmark` to segfault. After option parsing, the remaining argument (`10000`) is interpreted as a repeat count for an arbitrary command sequence. Since no command follows the repeat count, `start` becomes equal to `argc`. When `start` becomes equal to `argc`, the parser evaluates `sds_args[i][0]` before checking that `i` is still within bounds, resulting in an out-of-bounds read and undefined behaviour. This change guards the repeat-count parsing by checking `i < argc` before accessing `sds_args[i]`. Note: This avoids reading out of bounds but still does not handle what happens after that. Signed-off-by: lightsigma96 <8f34yashjadhav@gmail.com>
1 parent 168c22a commit 7bb7b7f

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

src/valkey-benchmark.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2513,7 +2513,7 @@ int main(int argc, char **argv) {
25132513
int seq_len = 0; /* Total number of commands in the sequence. */
25142514
sds cmd_seq = sdsempty();
25152515
for (i = 0; i <= argc; i++) {
2516-
if (i == start && sds_args[i][0] >= '1' && sds_args[i][0] <= '9') {
2516+
if (i < argc && i == start && sds_args[i][0] >= '1' && sds_args[i][0] <= '9') {
25172517
/* Command prefixed by number means repeat command N times. */
25182518
repeat = atoi(sds_args[i]);
25192519
start++;

0 commit comments

Comments
 (0)