Skip to content

Fix: Harden PhpRedis against protocol errors#2872

Merged
michael-grunder merged 1 commit into
developfrom
fix.protocol-errors
Jun 15, 2026
Merged

Fix: Harden PhpRedis against protocol errors#2872
michael-grunder merged 1 commit into
developfrom
fix.protocol-errors

Conversation

@michael-grunder

Copy link
Copy Markdown
Member
  • Fix a double free when zipping keys and scores.
  • Instead of aborting with an assertion if elements != 2 just warn and return failure
  • Instead of crashing on xclaim reply shape issues, just return false

* Fix a double free when zipping keys and scores.
* Instead of aborting with an assertion if elements != 2 just warn and
  return failure
* Instead of crashing on `xclaim` reply shape issues, just return false
Comment thread library.c
val = zval_get_tmp_string(z_value_p, &aux);

if (decode == SCORE_DECODE_INT && ZSTR_LEN(val) > 0) {
ZVAL_LONG(&z_sub, atoi(ZSTR_VAL(val)+1));

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@michael-grunder Do you remember why +1 here?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, I think because here we get :N\r\n

Comment thread library.c
if (decode == SCORE_DECODE_INT && ZSTR_LEN(val) > 0) {
ZVAL_LONG(&z_sub, atoi(ZSTR_VAL(val)+1));
} else if (decode == SCORE_DECODE_DOUBLE) {
ZVAL_DOUBLE(&z_sub, atof(ZSTR_VAL(val)));

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

And no +1 here?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

And here we just get <float>\r\nbecause in RESP2 it's a bulk reply

@michael-grunder michael-grunder merged commit ea3ea56 into develop Jun 15, 2026
159 of 171 checks passed
@michael-grunder michael-grunder deleted the fix.protocol-errors branch June 15, 2026 21:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants