diff --git a/src/t_string.c b/src/t_string.c index d4334b1eb6..7298fda6fc 100644 --- a/src/t_string.c +++ b/src/t_string.c @@ -800,10 +800,15 @@ void lcsCommand(client *c) { unsigned long long lcssize = (unsigned long long)(alen+1)*(blen+1); /* Can't overflow due to the size limits above. */ unsigned long long lcsalloc = lcssize * sizeof(uint32_t); uint32_t *lcs = NULL; - if (lcsalloc < SIZE_MAX && lcsalloc / lcssize == sizeof(uint32_t)) + if (lcsalloc < SIZE_MAX && lcsalloc / lcssize == sizeof(uint32_t)) { + if (lcsalloc > (size_t)server.proto_max_bulk_len) { + addReplyError(c, "Insufficient memory, transient memory for LCS exceeds proto-max-bulk-len"); + goto cleanup; + } lcs = ztrymalloc(lcsalloc); + } if (!lcs) { - addReplyError(c, "Insufficient memory"); + addReplyError(c, "Insufficient memory, failed allocating transient memory for LCS"); goto cleanup; } diff --git a/tests/integration/corrupt-dump.tcl b/tests/integration/corrupt-dump.tcl index cc811a6687..fe2b0e4654 100644 --- a/tests/integration/corrupt-dump.tcl +++ b/tests/integration/corrupt-dump.tcl @@ -732,5 +732,14 @@ test {corrupt payload: fuzzer findings - stream double free listpack when insert } } +test {corrupt payload: fuzzer findings - LCS OOM} { + start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] { + r SETRANGE _int 423324 1450173551 + catch {r LCS _int _int} err + assert_match "*Insufficient memory*" $err + r ping + } +} + } ;# tags