Files
Zijie Zhao 0c8c8e0f62 Fix ACL OOB for wrong-arity KEYNUM commands (#14847)
`luaRedisAclCheckCmdPermissionsCommand` and
`RM_ACLCheckCommandPermissions` now call `commandCheckArity()` to check
command arity before calling `ACLCheckAllUserCommandPerm`, matching the
behavior of `processCommand`, `scriptCall`, and `RM_Call`. Without this,
KEYNUM keyspec commands like EVAL with wrong arity cause out-of-bounds
argv access during key extraction.

Also fix KEYNUM index calculation (`first + keynumidx`) and add a bounds
check in genericGetKeys().

Add scripting and module ACL tests for wrong-arity `EVAL` to lock in the
non-crashing behavior.

Fixes #14843
2026-03-23 19:27:36 +02:00
..