Future proof our igbinary header check

michael-grunder · michael-grunder · commit 69355faae0ff · 2022-10-24T00:25:20.000-07:00
See: #2194
diff --git a/library.c b/library.c
@@ -3565,15 +3565,14 @@ redis_unserialize(RedisSock* redis_sock, const char *val, int val_len,
              * | header (4) | type (1) | ... (n) |  NUL (1) |
              * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
              *
-             * With header being either 0x00000001 or 0x00000002
-             * (encoded as big endian).
+             * With header being three zero bytes and one non-zero version
+             * specifier.  At the time of this comment, there is only version
+             * 0x01 and 0x02, but newer versions will use subsequent
+             * values.
              *
-             * Not all versions contain the trailing NULL byte though, so
-             * do not check for that.
+             * Not all versions contain a trailing \x00 so don't check for that.
              */
-            if (val_len < 5
-                    || (memcmp(val, "\x00\x00\x00\x01", 4) != 0
-                    && memcmp(val, "\x00\x00\x00\x02", 4) != 0))
+            if (val_len < 5 || memcmp(val, "\x00\x00\x00", 3) || val[3] < '\x01' || val[3] > '\x04')
             {
                 /* This is most definitely not an igbinary string, so do
                    not try to unserialize this as one. */
diff --git a/tests/RedisTest.php b/tests/RedisTest.php
@@ -4838,6 +4838,27 @@ public function testSerializerIGBinary() {
             $this->redis->setOption(Redis::OPT_PREFIX, "test:");
             $this->checkSerializer(Redis::SERIALIZER_IGBINARY);
             $this->redis->setOption(Redis::OPT_PREFIX, "");
+
+            /* Test our igbinary header check logic.  The check allows us to do
+               simple INCR type operations even with the serializer enabled, and
+               should also protect against igbinary-like data from being erroneously
+               deserialized */
+            $this->redis->del('incrkey');
+
+            $this->redis->set('spoof-1', "\x00\x00\x00\x00");
+            $this->redis->set('spoof-2', "\x00\x00\x00\x00bad-version1");
+            $this->redis->set('spoof-3', "\x00\x00\x00\x05bad-version2");
+            $this->redis->setOption(Redis::OPT_SERIALIZER, Redis::SERIALIZER_IGBINARY);
+
+            $this->assertEquals(16, $this->redis->incrby('incrkey', 16));
+            $this->assertEquals('16', $this->redis->get('incrkey'));
+
+            $this->assertEquals("\x00\x00\x00\x00", $this->redis->get('spoof-1'));
+            $this->assertEquals("\x00\x00\x00\x00bad-version1", $this->redis->get('spoof-2'));
+            $this->assertEquals("\x00\x00\x00\x05bad-version2", $this->redis->get('spoof-3'));
+            $this->redis->setOption(Redis::OPT_SERIALIZER, Redis::SERIALIZER_NONE);
+
+            $this->redis->del('incrkey', 'spoof-1', 'spoof-2', 'spoof-3');
         }
     }
 
