1
0

corrupt-dump.tcl 50 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730
  1. # tests of corrupt ziplist payload with valid CRC
  2. # * setting crash-memcheck-enabled to no to avoid issues with valgrind
  3. # * setting use-exit-on-panic to yes so that valgrind can search for leaks
  4. # * setting debug set-skip-checksum-validation to 1 on some tests for which we
  5. # didn't bother to fake a valid checksum
  6. # * some tests set sanitize-dump-payload to no and some to yet, depending on
  7. # what we want to test
  8. tags {"dump" "corruption" "external:skip"} {
  9. # We only run OOM related tests on x86_64 and aarch64, as jemalloc on other
  10. # platforms (notably s390x) may actually succeed very large allocations. As
  11. # a result the test may hang for a very long time at the cleanup phase,
  12. # iterating as many as 2^61 hash table slots.
  13. set arch_name [exec uname -m]
  14. set run_oom_tests [expr {$arch_name == "x86_64" || $arch_name == "aarch64"}]
  15. set corrupt_payload_7445 "\x0E\x01\x1D\x1D\x00\x00\x00\x16\x00\x00\x00\x03\x00\x00\x04\x43\x43\x43\x43\x06\x04\x42\x42\x42\x42\x06\x3F\x41\x41\x41\x41\xFF\x09\x00\x88\xA5\xCA\xA8\xC5\x41\xF4\x35"
  16. test {corrupt payload: #7445 - with sanitize} {
  17. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  18. r config set sanitize-dump-payload yes
  19. catch {
  20. r restore key 0 $corrupt_payload_7445
  21. } err
  22. assert_match "*Bad data format*" $err
  23. verify_log_message 0 "*integrity check failed*" 0
  24. }
  25. }
  26. test {corrupt payload: #7445 - without sanitize - 1} {
  27. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  28. r config set sanitize-dump-payload no
  29. r restore key 0 $corrupt_payload_7445
  30. catch {r lindex key 2}
  31. assert_equal [count_log_message 0 "crashed by signal"] 0
  32. assert_equal [count_log_message 0 "ASSERTION FAILED"] 1
  33. }
  34. }
  35. test {corrupt payload: #7445 - without sanitize - 2} {
  36. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  37. r config set sanitize-dump-payload no
  38. r restore key 0 $corrupt_payload_7445
  39. catch {r lset key 2 "BEEF"}
  40. assert_equal [count_log_message 0 "crashed by signal"] 0
  41. assert_equal [count_log_message 0 "ASSERTION FAILED"] 1
  42. }
  43. }
  44. test {corrupt payload: hash with valid zip list header, invalid entry len} {
  45. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  46. catch {
  47. r restore key 0 "\x0D\x1B\x1B\x00\x00\x00\x16\x00\x00\x00\x04\x00\x00\x02\x61\x00\x04\x02\x62\x00\x04\x14\x63\x00\x04\x02\x64\x00\xFF\x09\x00\xD9\x10\x54\x92\x15\xF5\x5F\x52"
  48. } err
  49. assert_match "*Bad data format*" $err
  50. verify_log_message 0 "*integrity check failed*" 0
  51. }
  52. }
  53. test {corrupt payload: invalid zlbytes header} {
  54. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  55. catch {
  56. r restore key 0 "\x0D\x1B\x25\x00\x00\x00\x16\x00\x00\x00\x04\x00\x00\x02\x61\x00\x04\x02\x62\x00\x04\x02\x63\x00\x04\x02\x64\x00\xFF\x09\x00\xB7\xF7\x6E\x9F\x43\x43\x14\xC6"
  57. } err
  58. assert_match "*Bad data format*" $err
  59. verify_log_message 0 "*integrity check failed*" 0
  60. }
  61. }
  62. test {corrupt payload: valid zipped hash header, dup records} {
  63. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  64. catch {
  65. r restore key 0 "\x0D\x1B\x1B\x00\x00\x00\x16\x00\x00\x00\x04\x00\x00\x02\x61\x00\x04\x02\x62\x00\x04\x02\x61\x00\x04\x02\x64\x00\xFF\x09\x00\xA1\x98\x36\x78\xCC\x8E\x93\x2E"
  66. } err
  67. assert_match "*Bad data format*" $err
  68. verify_log_message 0 "*integrity check failed*" 0
  69. }
  70. }
  71. test {corrupt payload: quicklist big ziplist prev len} {
  72. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  73. r config set sanitize-dump-payload no
  74. r restore key 0 "\x0E\x01\x13\x13\x00\x00\x00\x0E\x00\x00\x00\x02\x00\x00\x02\x61\x00\x0E\x02\x62\x00\xFF\x09\x00\x49\x97\x30\xB2\x0D\xA1\xED\xAA"
  75. catch {r lindex key -2}
  76. assert_equal [count_log_message 0 "crashed by signal"] 0
  77. assert_equal [count_log_message 0 "ASSERTION FAILED"] 1
  78. }
  79. }
  80. test {corrupt payload: quicklist small ziplist prev len} {
  81. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  82. r config set sanitize-dump-payload yes
  83. catch {
  84. r restore key 0 "\x0E\x01\x13\x13\x00\x00\x00\x0E\x00\x00\x00\x02\x00\x00\x02\x61\x00\x02\x02\x62\x00\xFF\x09\x00\xC7\x71\x03\x97\x07\x75\xB0\x63"
  85. } err
  86. assert_match "*Bad data format*" $err
  87. verify_log_message 0 "*integrity check failed*" 0
  88. }
  89. }
  90. test {corrupt payload: quicklist ziplist wrong count} {
  91. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  92. r config set sanitize-dump-payload no
  93. r restore key 0 "\x0E\x01\x13\x13\x00\x00\x00\x0E\x00\x00\x00\x03\x00\x00\x02\x61\x00\x04\x02\x62\x00\xFF\x09\x00\x4D\xE2\x0A\x2F\x08\x25\xDF\x91"
  94. # we'll be able to push, but iterating on the list will assert
  95. r lpush key header
  96. r rpush key footer
  97. catch { [r lrange key -1 -1] }
  98. assert_equal [count_log_message 0 "crashed by signal"] 0
  99. assert_equal [count_log_message 0 "ASSERTION FAILED"] 1
  100. }
  101. }
  102. test {corrupt payload: #3080 - quicklist} {
  103. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  104. r config set sanitize-dump-payload no
  105. catch {
  106. r RESTORE key 0 "\x0E\x01\x80\x00\x00\x00\x10\x41\x41\x41\x41\x41\x41\x41\x41\x02\x00\x00\x80\x41\x41\x41\x41\x07\x00\x03\xC7\x1D\xEF\x54\x68\xCC\xF3"
  107. r DUMP key ;# DUMP was used in the original issue, but now even with shallow sanitization restore safely fails, so this is dead code
  108. } err
  109. assert_match "*Bad data format*" $err
  110. verify_log_message 0 "*integrity check failed*" 0
  111. }
  112. }
  113. test {corrupt payload: quicklist with empty ziplist} {
  114. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  115. r config set sanitize-dump-payload no
  116. r debug set-skip-checksum-validation 1
  117. catch {r restore key 0 "\x0E\x01\x0B\x0B\x00\x00\x00\x0A\x00\x00\x00\x00\x00\xFF\x09\x00\xC2\x69\x37\x83\x3C\x7F\xFE\x6F" replace} err
  118. assert_match "*Bad data format*" $err
  119. r ping
  120. }
  121. }
  122. test {corrupt payload: #3080 - ziplist} {
  123. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  124. # shallow sanitization is enough for restore to safely reject the payload with wrong size
  125. r config set sanitize-dump-payload no
  126. catch {
  127. r RESTORE key 0 "\x0A\x80\x00\x00\x00\x10\x41\x41\x41\x41\x41\x41\x41\x41\x02\x00\x00\x80\x41\x41\x41\x41\x07\x00\x39\x5B\x49\xE0\xC1\xC6\xDD\x76"
  128. } err
  129. assert_match "*Bad data format*" $err
  130. verify_log_message 0 "*integrity check failed*" 0
  131. }
  132. }
  133. test {corrupt payload: load corrupted rdb with no CRC - #3505} {
  134. set server_path [tmpdir "server.rdb-corruption-test"]
  135. exec cp tests/assets/corrupt_ziplist.rdb $server_path
  136. set srv [start_server [list overrides [list "dir" $server_path "dbfilename" "corrupt_ziplist.rdb" loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no sanitize-dump-payload no]]]
  137. # wait for termination
  138. wait_for_condition 100 50 {
  139. ! [is_alive $srv]
  140. } else {
  141. fail "rdb loading didn't fail"
  142. }
  143. set stdout [dict get $srv stdout]
  144. assert_equal [count_message_lines $stdout "Terminating server after rdb file reading failure."] 1
  145. assert_lessthan 1 [count_message_lines $stdout "integrity check failed"]
  146. kill_server $srv ;# let valgrind look for issues
  147. }
  148. foreach sanitize_dump {no yes} {
  149. test {corrupt payload: load corrupted rdb with empty keys} {
  150. set server_path [tmpdir "server.rdb-corruption-empty-keys-test"]
  151. exec cp tests/assets/corrupt_empty_keys.rdb $server_path
  152. start_server [list overrides [list "dir" $server_path "dbfilename" "corrupt_empty_keys.rdb" "sanitize-dump-payload" $sanitize_dump]] {
  153. r select 0
  154. assert_equal [r dbsize] 0
  155. verify_log_message 0 "*skipping empty key: set*" 0
  156. verify_log_message 0 "*skipping empty key: list_quicklist*" 0
  157. verify_log_message 0 "*skipping empty key: list_quicklist_empty_ziplist*" 0
  158. verify_log_message 0 "*skipping empty key: list_ziplist*" 0
  159. verify_log_message 0 "*skipping empty key: hash*" 0
  160. verify_log_message 0 "*skipping empty key: hash_ziplist*" 0
  161. verify_log_message 0 "*skipping empty key: zset*" 0
  162. verify_log_message 0 "*skipping empty key: zset_ziplist*" 0
  163. verify_log_message 0 "*empty keys skipped: 8*" 0
  164. }
  165. }
  166. }
  167. test {corrupt payload: listpack invalid size header} {
  168. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  169. r config set sanitize-dump-payload no
  170. catch {
  171. r restore key 0 "\x0F\x01\x10\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x02\x40\x55\x5F\x00\x00\x00\x0F\x00\x01\x01\x00\x01\x02\x01\x88\x31\x00\x00\x00\x00\x00\x00\x00\x09\x88\x32\x00\x00\x00\x00\x00\x00\x00\x09\x00\x01\x00\x01\x00\x01\x00\x01\x02\x02\x88\x31\x00\x00\x00\x00\x00\x00\x00\x09\x88\x61\x00\x00\x00\x00\x00\x00\x00\x09\x88\x32\x00\x00\x00\x00\x00\x00\x00\x09\x88\x62\x00\x00\x00\x00\x00\x00\x00\x09\x08\x01\xFF\x0A\x01\x00\x00\x09\x00\x45\x91\x0A\x87\x2F\xA5\xF9\x2E"
  172. } err
  173. assert_match "*Bad data format*" $err
  174. verify_log_message 0 "*Stream listpack integrity check failed*" 0
  175. }
  176. }
  177. test {corrupt payload: listpack too long entry len} {
  178. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  179. r config set sanitize-dump-payload no
  180. r restore key 0 "\x0F\x01\x10\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x02\x40\x55\x55\x00\x00\x00\x0F\x00\x01\x01\x00\x01\x02\x01\x88\x31\x00\x00\x00\x00\x00\x00\x00\x09\x88\x32\x00\x00\x00\x00\x00\x00\x00\x09\x00\x01\x00\x01\x00\x01\x00\x01\x02\x02\x89\x31\x00\x00\x00\x00\x00\x00\x00\x09\x88\x61\x00\x00\x00\x00\x00\x00\x00\x09\x88\x32\x00\x00\x00\x00\x00\x00\x00\x09\x88\x62\x00\x00\x00\x00\x00\x00\x00\x09\x08\x01\xFF\x0A\x01\x00\x00\x09\x00\x40\x63\xC9\x37\x03\xA2\xE5\x68"
  181. catch {
  182. r xinfo stream key full
  183. } err
  184. assert_equal [count_log_message 0 "crashed by signal"] 0
  185. assert_equal [count_log_message 0 "ASSERTION FAILED"] 1
  186. }
  187. }
  188. test {corrupt payload: listpack very long entry len} {
  189. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  190. r config set sanitize-dump-payload no
  191. r restore key 0 "\x0F\x01\x10\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x02\x40\x55\x55\x00\x00\x00\x0F\x00\x01\x01\x00\x01\x02\x01\x88\x31\x00\x00\x00\x00\x00\x00\x00\x09\x88\x32\x00\x00\x00\x00\x00\x00\x00\x09\x00\x01\x00\x01\x00\x01\x00\x01\x02\x02\x88\x31\x00\x00\x00\x00\x00\x00\x00\x09\x88\x61\x00\x00\x00\x00\x00\x00\x00\x09\x88\x32\x00\x00\x00\x00\x00\x00\x00\x09\x9C\x62\x00\x00\x00\x00\x00\x00\x00\x09\x08\x01\xFF\x0A\x01\x00\x00\x09\x00\x63\x6F\x42\x8E\x7C\xB5\xA2\x9D"
  192. catch {
  193. r xinfo stream key full
  194. } err
  195. assert_equal [count_log_message 0 "crashed by signal"] 0
  196. assert_equal [count_log_message 0 "ASSERTION FAILED"] 1
  197. }
  198. }
  199. test {corrupt payload: listpack too long entry prev len} {
  200. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  201. r config set sanitize-dump-payload yes
  202. catch {
  203. r restore key 0 "\x0F\x01\x10\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x02\x40\x55\x55\x00\x00\x00\x0F\x00\x01\x01\x00\x15\x02\x01\x88\x31\x00\x00\x00\x00\x00\x00\x00\x09\x88\x32\x00\x00\x00\x00\x00\x00\x00\x09\x00\x01\x00\x01\x00\x01\x00\x01\x02\x02\x88\x31\x00\x00\x00\x00\x00\x00\x00\x09\x88\x61\x00\x00\x00\x00\x00\x00\x00\x09\x88\x32\x00\x00\x00\x00\x00\x00\x00\x09\x88\x62\x00\x00\x00\x00\x00\x00\x00\x09\x08\x01\xFF\x0A\x01\x00\x00\x09\x00\x06\xFB\x44\x24\x0A\x8E\x75\xEA"
  204. } err
  205. assert_match "*Bad data format*" $err
  206. verify_log_message 0 "*Stream listpack integrity check failed*" 0
  207. }
  208. }
  209. test {corrupt payload: hash ziplist with duplicate records} {
  210. # when we do perform full sanitization, we expect duplicate records to fail the restore
  211. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  212. r config set sanitize-dump-payload yes
  213. r debug set-skip-checksum-validation 1
  214. catch { r RESTORE _hash 0 "\x0D\x3D\x3D\x00\x00\x00\x3A\x00\x00\x00\x14\x13\x00\xF5\x02\xF5\x02\xF2\x02\x53\x5F\x31\x04\xF3\x02\xF3\x02\xF7\x02\xF7\x02\xF8\x02\x02\x5F\x37\x04\xF1\x02\xF1\x02\xF6\x02\x02\x5F\x35\x04\xF4\x02\x02\x5F\x33\x04\xFA\x02\x02\x5F\x39\x04\xF9\x02\xF9\xFF\x09\x00\xB5\x48\xDE\x62\x31\xD0\xE5\x63" } err
  215. assert_match "*Bad data format*" $err
  216. }
  217. }
  218. test {corrupt payload: hash listpack with duplicate records} {
  219. # when we do perform full sanitization, we expect duplicate records to fail the restore
  220. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  221. r config set sanitize-dump-payload yes
  222. r debug set-skip-checksum-validation 1
  223. catch { r RESTORE _hash 0 "\x10\x17\x17\x00\x00\x00\x04\x00\x82a\x00\x03\x82b\x00\x03\x82a\x00\x03\x82d\x00\x03\xff\n\x00\xc0\xcf\xa6\x87\xe5\xa7\xc5\xbe" } err
  224. assert_match "*Bad data format*" $err
  225. }
  226. }
  227. test {corrupt payload: hash ziplist uneven record count} {
  228. # when we do perform full sanitization, we expect duplicate records to fail the restore
  229. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  230. r config set sanitize-dump-payload yes
  231. r debug set-skip-checksum-validation 1
  232. catch { r RESTORE _hash 0 "\r\x1b\x1b\x00\x00\x00\x16\x00\x00\x00\x04\x00\x00\x02a\x00\x04\x02b\x00\x04\x02a\x00\x04\x02d\x00\xff\t\x00\xa1\x98\x36x\xcc\x8e\x93\x2e" } err
  233. assert_match "*Bad data format*" $err
  234. }
  235. }
  236. test {corrupt payload: hash duplicate records} {
  237. # when we do perform full sanitization, we expect duplicate records to fail the restore
  238. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  239. r config set sanitize-dump-payload yes
  240. r debug set-skip-checksum-validation 1
  241. catch { r RESTORE _hash 0 "\x04\x02\x01a\x01b\x01a\x01d\t\x00\xc6\x9c\xab\xbc\bk\x0c\x06" } err
  242. assert_match "*Bad data format*" $err
  243. }
  244. }
  245. test {corrupt payload: hash empty zipmap} {
  246. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  247. r config set sanitize-dump-payload no
  248. r debug set-skip-checksum-validation 1
  249. catch { r RESTORE _hash 0 "\x09\x02\x00\xFF\x09\x00\xC0\xF1\xB8\x67\x4C\x16\xAC\xE3" } err
  250. assert_match "*Bad data format*" $err
  251. verify_log_message 0 "*Zipmap integrity check failed*" 0
  252. }
  253. }
  254. test {corrupt payload: fuzzer findings - NPD in streamIteratorGetID} {
  255. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  256. r config set sanitize-dump-payload no
  257. r debug set-skip-checksum-validation 1
  258. catch {
  259. r RESTORE key 0 "\x0F\x01\x10\x00\x00\x01\x73\xBD\x68\x48\x71\x00\x00\x00\x00\x00\x00\x00\x00\x40\x42\x42\x00\x00\x00\x18\x00\x03\x01\x00\x01\x02\x01\x84\x69\x74\x65\x6D\x05\x85\x76\x61\x6C\x75\x65\x06\x00\x01\x02\x01\x00\x01\x00\x01\x01\x01\x00\x01\x05\x01\x02\x01\x00\x01\x01\x01\x01\x01\x82\x5F\x31\x03\x05\x01\x02\x01\x00\x01\x02\x01\x01\x01\x02\x01\x48\x01\xFF\x03\x81\x00\x00\x01\x73\xBD\x68\x48\x71\x02\x01\x07\x6D\x79\x67\x72\x6F\x75\x70\x81\x00\x00\x01\x73\xBD\x68\x48\x71\x00\x01\x00\x00\x01\x73\xBD\x68\x48\x71\x00\x00\x00\x00\x00\x00\x00\x00\x72\x48\x68\xBD\x73\x01\x00\x00\x01\x01\x05\x41\x6C\x69\x63\x65\x72\x48\x68\xBD\x73\x01\x00\x00\x01\x00\x00\x01\x73\xBD\x68\x48\x71\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x80\xCD\xB0\xD5\x1A\xCE\xFF\x10"
  260. r XREVRANGE key 725 233
  261. }
  262. assert_equal [count_log_message 0 "crashed by signal"] 0
  263. assert_equal [count_log_message 0 "ASSERTION FAILED"] 1
  264. }
  265. }
  266. test {corrupt payload: fuzzer findings - listpack NPD on invalid stream} {
  267. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  268. r config set sanitize-dump-payload no
  269. r debug set-skip-checksum-validation 1
  270. catch {
  271. r RESTORE _stream 0 "\x0F\x01\x10\x00\x00\x01\x73\xDC\xB6\x6B\xF1\x00\x00\x00\x00\x00\x00\x00\x00\x40\x42\x42\x00\x00\x00\x18\x00\x03\x01\x00\x01\x02\x01\x84\x69\x74\x65\x6D\x05\x85\x76\x61\x6C\x75\x65\x06\x00\x01\x02\x01\x00\x01\x00\x01\x01\x01\x00\x01\x05\x01\x02\x01\x1F\x01\x00\x01\x01\x01\x6D\x5F\x31\x03\x05\x01\x02\x01\x29\x01\x00\x01\x01\x01\x02\x01\x05\x01\xFF\x03\x81\x00\x00\x01\x73\xDC\xB6\x6C\x1A\x00\x01\x07\x6D\x79\x67\x72\x6F\x75\x70\x81\x00\x00\x01\x73\xDC\xB6\x6B\xF1\x00\x01\x00\x00\x01\x73\xDC\xB6\x6B\xF1\x00\x00\x00\x00\x00\x00\x00\x00\x4B\x6C\xB6\xDC\x73\x01\x00\x00\x01\x01\x05\x41\x6C\x69\x63\x65\x3D\x6C\xB6\xDC\x73\x01\x00\x00\x01\x00\x00\x01\x73\xDC\xB6\x6B\xF1\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\xC7\x7D\x1C\xD7\x04\xFF\xE6\x9D"
  272. r XREAD STREAMS _stream 519389898758
  273. }
  274. assert_equal [count_log_message 0 "crashed by signal"] 0
  275. assert_equal [count_log_message 0 "ASSERTION FAILED"] 1
  276. }
  277. }
  278. test {corrupt payload: fuzzer findings - NPD in quicklistIndex} {
  279. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  280. r config set sanitize-dump-payload no
  281. r debug set-skip-checksum-validation 1
  282. catch {
  283. r RESTORE key 0 "\x0E\x01\x13\x13\x00\x00\x00\x10\x00\x00\x00\x03\x12\x00\xF3\x02\x02\x5F\x31\x04\xF1\xFF\x09\x00\xC9\x4B\x31\xFE\x61\xC0\x96\xFE"
  284. r LSET key 290 290
  285. }
  286. assert_equal [count_log_message 0 "crashed by signal"] 0
  287. assert_equal [count_log_message 0 "ASSERTION FAILED"] 1
  288. }
  289. }
  290. test {corrupt payload: fuzzer findings - encoded entry header reach outside the allocation} {
  291. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  292. r debug set-skip-checksum-validation 1
  293. catch {
  294. r RESTORE key 0 "\x0D\x19\x19\x00\x00\x00\x16\x00\x00\x00\x06\x00\x00\xF1\x02\xF1\x02\xF2\x02\x02\x5F\x31\x04\x99\x02\xF3\xFF\x09\x00\xC5\xB8\x10\xC0\x8A\xF9\x16\xDF"
  295. } err
  296. assert_match "*Bad data format*" $err
  297. verify_log_message 0 "*integrity check failed*" 0
  298. }
  299. }
  300. test {corrupt payload: fuzzer findings - invalid ziplist encoding} {
  301. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  302. r config set sanitize-dump-payload yes
  303. r debug set-skip-checksum-validation 1
  304. catch {
  305. r RESTORE _listbig 0 "\x0E\x02\x1B\x1B\x00\x00\x00\x16\x00\x00\x00\x05\x00\x00\x02\x5F\x39\x04\xF9\x02\x86\x5F\x37\x04\xF7\x02\x02\x5F\x35\xFF\x19\x19\x00\x00\x00\x16\x00\x00\x00\x05\x00\x00\xF5\x02\x02\x5F\x33\x04\xF3\x02\x02\x5F\x31\x04\xF1\xFF\x09\x00\x0C\xFC\x99\x2C\x23\x45\x15\x60"
  306. } err
  307. assert_match "*Bad data format*" $err
  308. verify_log_message 0 "*integrity check failed*" 0
  309. }
  310. }
  311. test {corrupt payload: fuzzer findings - hash crash} {
  312. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  313. r config set sanitize-dump-payload yes
  314. r debug set-skip-checksum-validation 1
  315. r RESTORE _hash 0 "\x0D\x19\x19\x00\x00\x00\x16\x00\x00\x00\x06\x00\x00\xF1\x02\xF1\x02\xF2\x02\x02\x5F\x31\x04\xF3\x02\xF3\xFF\x09\x00\x38\xB8\x10\xC0\x8A\xF9\x16\xDF"
  316. r HSET _hash 394891450 1635910264
  317. r HMGET _hash 887312884855
  318. }
  319. }
  320. test {corrupt payload: fuzzer findings - uneven entry count in hash} {
  321. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  322. r debug set-skip-checksum-validation 1
  323. catch {
  324. r RESTORE _hashbig 0 "\x0D\x3D\x3D\x00\x00\x00\x38\x00\x00\x00\x14\x00\x00\xF2\x02\x02\x5F\x31\x04\x1C\x02\xF7\x02\xF1\x02\xF1\x02\xF5\x02\xF5\x02\xF4\x02\x02\x5F\x33\x04\xF6\x02\x02\x5F\x35\x04\xF8\x02\x02\x5F\x37\x04\xF9\x02\xF9\x02\xF3\x02\xF3\x02\xFA\x02\x02\x5F\x39\xFF\x09\x00\x73\xB7\x68\xC8\x97\x24\x8E\x88"
  325. } err
  326. assert_match "*Bad data format*" $err
  327. verify_log_message 0 "*integrity check failed*" 0
  328. }
  329. }
  330. test {corrupt payload: fuzzer findings - invalid read in lzf_decompress} {
  331. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  332. r config set sanitize-dump-payload no
  333. r debug set-skip-checksum-validation 1
  334. catch { r RESTORE _setbig 0 "\x02\x03\x02\x5F\x31\xC0\x02\xC3\x00\x09\x00\xE6\xDC\x76\x44\xFF\xEB\x3D\xFE" } err
  335. assert_match "*Bad data format*" $err
  336. }
  337. }
  338. test {corrupt payload: fuzzer findings - leak in rdbloading due to dup entry in set} {
  339. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  340. r config set sanitize-dump-payload no
  341. r debug set-skip-checksum-validation 1
  342. catch { r RESTORE _setbig 0 "\x02\x0A\x02\x5F\x39\xC0\x06\x02\x5F\x31\xC0\x00\xC0\x04\x02\x5F\x35\xC0\x02\xC0\x08\x02\x5F\x31\x02\x5F\x33\x09\x00\x7A\x5A\xFB\x90\x3A\xE9\x3C\xBE" } err
  343. assert_match "*Bad data format*" $err
  344. }
  345. }
  346. test {corrupt payload: fuzzer findings - empty intset} {
  347. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  348. r config set sanitize-dump-payload no
  349. r debug set-skip-checksum-validation 1
  350. catch {r RESTORE _setbig 0 "\x02\xC0\xC0\x06\x02\x5F\x39\xC0\x02\x02\x5F\x33\xC0\x00\x02\x5F\x31\xC0\x04\xC0\x08\x02\x5F\x37\x02\x5F\x35\x09\x00\xC5\xD4\x6D\xBA\xAD\x14\xB7\xE7"} err
  351. assert_match "*Bad data format*" $err
  352. r ping
  353. }
  354. }
  355. test {corrupt payload: fuzzer findings - valgrind ziplist - crash report prints freed memory} {
  356. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  357. r config set sanitize-dump-payload no
  358. r debug set-skip-checksum-validation 1
  359. r RESTORE _zsetbig 0 "\x0C\x3D\x3D\x00\x00\x00\x3A\x00\x00\x00\x14\x00\x00\xF1\x02\xF1\x02\x02\x5F\x31\x04\xF2\x02\xF3\x02\xF3\x02\x02\x5F\x33\x04\xF4\x02\xEE\x02\xF5\x02\x02\x5F\x35\x04\xF6\x02\xF7\x02\xF7\x02\x02\x5F\x37\x04\xF8\x02\xF9\x02\xF9\x02\x02\x5F\x39\x04\xFA\xFF\x09\x00\xAE\xF9\x77\x2A\x47\x24\x33\xF6"
  360. catch { r ZREMRANGEBYSCORE _zsetbig -1050966020 724 }
  361. assert_equal [count_log_message 0 "crashed by signal"] 0
  362. assert_equal [count_log_message 0 "ASSERTION FAILED"] 1
  363. }
  364. }
  365. test {corrupt payload: fuzzer findings - valgrind ziplist prevlen reaches outside the ziplist} {
  366. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  367. r config set sanitize-dump-payload no
  368. r debug set-skip-checksum-validation 1
  369. r RESTORE _listbig 0 "\x0E\x02\x1B\x1B\x00\x00\x00\x16\x00\x00\x00\x05\x00\x00\x02\x5F\x39\x04\xF9\x02\x02\x5F\x37\x04\xF7\x02\x02\x5F\x35\xFF\x19\x19\x00\x00\x00\x16\x00\x00\x00\x05\x00\x00\xF5\x02\x02\x5F\x33\x04\xF3\x95\x02\x5F\x31\x04\xF1\xFF\x09\x00\x0C\xFC\x99\x2C\x23\x45\x15\x60"
  370. catch { r RPOP _listbig }
  371. catch { r RPOP _listbig }
  372. catch { r RPUSH _listbig 949682325 }
  373. assert_equal [count_log_message 0 "crashed by signal"] 0
  374. assert_equal [count_log_message 0 "ASSERTION FAILED"] 1
  375. }
  376. }
  377. test {corrupt payload: fuzzer findings - valgrind - bad rdbLoadDoubleValue} {
  378. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  379. r config set sanitize-dump-payload no
  380. r debug set-skip-checksum-validation 1
  381. catch { r RESTORE _list 0 "\x03\x01\x11\x11\x00\x00\x00\x0A\x00\x00\x00\x01\x00\x00\xD0\x07\x1A\xE9\x02\xFF\x09\x00\x1A\x06\x07\x32\x41\x28\x3A\x46" } err
  382. assert_match "*Bad data format*" $err
  383. }
  384. }
  385. test {corrupt payload: fuzzer findings - valgrind ziplist prev too big} {
  386. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  387. r config set sanitize-dump-payload no
  388. r debug set-skip-checksum-validation 1
  389. r RESTORE _list 0 "\x0E\x01\x13\x13\x00\x00\x00\x10\x00\x00\x00\x03\x00\x00\xF3\x02\x02\x5F\x31\xC1\xF1\xFF\x09\x00\xC9\x4B\x31\xFE\x61\xC0\x96\xFE"
  390. catch { r RPUSHX _list -45 }
  391. catch { r LREM _list -748 -840}
  392. assert_equal [count_log_message 0 "crashed by signal"] 0
  393. assert_equal [count_log_message 0 "ASSERTION FAILED"] 1
  394. }
  395. }
  396. test {corrupt payload: fuzzer findings - lzf decompression fails, avoid valgrind invalid read} {
  397. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  398. r config set sanitize-dump-payload no
  399. r debug set-skip-checksum-validation 1
  400. catch {r RESTORE _stream 0 "\x0F\x02\x10\x00\x00\x01\x73\xDD\xAA\x2A\xB9\x00\x00\x00\x00\x00\x00\x00\x00\xC3\x40\x4B\x40\x5C\x18\x5C\x00\x00\x00\x24\x00\x05\x01\x00\x01\x02\x01\x84\x69\x74\x65\x6D\x05\x85\x76\x61\x6C\x75\x65\x06\x40\x10\x00\x00\x20\x01\x00\x01\x20\x03\x00\x05\x20\x1C\x40\x07\x05\x01\x01\x82\x5F\x31\x03\x80\x0D\x40\x00\x00\x02\x60\x19\x40\x27\x40\x19\x00\x33\x60\x19\x40\x29\x02\x01\x01\x04\x20\x19\x00\xFF\x10\x00\x00\x01\x73\xDD\xAA\x2A\xBC\x00\x00\x00\x00\x00\x00\x00\x00\xC3\x40\x4D\x40\x5E\x18\x5E\x00\x00\x00\x24\x00\x05\x01\x00\x01\x02\x01\x84\x69\x74\x65\x6D\x05\x85\x76\x61\x6C\x75\x65\x06\x40\x10\x00\x00\x20\x01\x06\x01\x01\x82\x5F\x35\x03\x05\x20\x1E\x17\x0B\x03\x01\x01\x06\x01\x40\x0B\x00\x01\x60\x0D\x02\x82\x5F\x37\x60\x19\x80\x00\x00\x08\x60\x19\x80\x27\x02\x82\x5F\x39\x20\x19\x00\xFF\x0A\x81\x00\x00\x01\x73\xDD\xAA\x2A\xBE\x00\x00\x09\x00\x21\x85\x77\x43\x71\x7B\x17\x88"} err
  401. assert_match "*Bad data format*" $err
  402. }
  403. }
  404. test {corrupt payload: fuzzer findings - stream bad lp_count} {
  405. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  406. r config set sanitize-dump-payload yes
  407. r debug set-skip-checksum-validation 1
  408. catch { r RESTORE _stream 0 "\x0F\x01\x10\x00\x00\x01\x73\xDE\xDF\x7D\x9B\x00\x00\x00\x00\x00\x00\x00\x00\x40\x42\x42\x00\x00\x00\x18\x00\x03\x01\x00\x01\x02\x01\x84\x69\x74\x65\x6D\x05\x85\x76\x61\x6C\x75\x65\x06\x00\x01\x02\x01\x00\x01\x00\x01\x01\x01\x00\x01\x56\x01\x02\x01\x22\x01\x00\x01\x01\x01\x82\x5F\x31\x03\x05\x01\x02\x01\x2C\x01\x00\x01\x01\x01\x02\x01\x05\x01\xFF\x03\x81\x00\x00\x01\x73\xDE\xDF\x7D\xC7\x00\x01\x07\x6D\x79\x67\x72\x6F\x75\x70\x81\x00\x00\x01\x73\xDE\xDF\x7D\x9B\x00\x01\x00\x00\x01\x73\xDE\xDF\x7D\x9B\x00\x00\x00\x00\x00\x00\x00\x00\xF9\x7D\xDF\xDE\x73\x01\x00\x00\x01\x01\x05\x41\x6C\x69\x63\x65\xEB\x7D\xDF\xDE\x73\x01\x00\x00\x01\x00\x00\x01\x73\xDE\xDF\x7D\x9B\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\xB2\xA8\xA7\x5F\x1B\x61\x72\xD5"} err
  409. assert_match "*Bad data format*" $err
  410. r ping
  411. }
  412. }
  413. test {corrupt payload: fuzzer findings - stream bad lp_count - unsanitized} {
  414. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  415. r config set sanitize-dump-payload no
  416. r debug set-skip-checksum-validation 1
  417. r RESTORE _stream 0 "\x0F\x01\x10\x00\x00\x01\x73\xDE\xDF\x7D\x9B\x00\x00\x00\x00\x00\x00\x00\x00\x40\x42\x42\x00\x00\x00\x18\x00\x03\x01\x00\x01\x02\x01\x84\x69\x74\x65\x6D\x05\x85\x76\x61\x6C\x75\x65\x06\x00\x01\x02\x01\x00\x01\x00\x01\x01\x01\x00\x01\x56\x01\x02\x01\x22\x01\x00\x01\x01\x01\x82\x5F\x31\x03\x05\x01\x02\x01\x2C\x01\x00\x01\x01\x01\x02\x01\x05\x01\xFF\x03\x81\x00\x00\x01\x73\xDE\xDF\x7D\xC7\x00\x01\x07\x6D\x79\x67\x72\x6F\x75\x70\x81\x00\x00\x01\x73\xDE\xDF\x7D\x9B\x00\x01\x00\x00\x01\x73\xDE\xDF\x7D\x9B\x00\x00\x00\x00\x00\x00\x00\x00\xF9\x7D\xDF\xDE\x73\x01\x00\x00\x01\x01\x05\x41\x6C\x69\x63\x65\xEB\x7D\xDF\xDE\x73\x01\x00\x00\x01\x00\x00\x01\x73\xDE\xDF\x7D\x9B\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\xB2\xA8\xA7\x5F\x1B\x61\x72\xD5"
  418. catch { r XREVRANGE _stream 638932639 738}
  419. assert_equal [count_log_message 0 "crashed by signal"] 0
  420. assert_equal [count_log_message 0 "ASSERTION FAILED"] 1
  421. }
  422. }
  423. test {corrupt payload: fuzzer findings - stream integrity check issue} {
  424. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  425. r config set sanitize-dump-payload yes
  426. r debug set-skip-checksum-validation 1
  427. catch { r RESTORE _stream 0 "\x0F\x02\x10\x00\x00\x01\x75\x2D\xA2\x90\x67\x00\x00\x00\x00\x00\x00\x00\x00\xC3\x40\x4F\x40\x5C\x18\x5C\x00\x00\x00\x24\x00\x05\x01\x00\x01\x4A\x01\x84\x69\x74\x65\x6D\x05\x85\x76\x61\x6C\x75\x65\x06\x40\x10\x00\x00\x20\x01\x00\x01\x20\x03\x00\x05\x20\x1C\x40\x09\x05\x01\x01\x82\x5F\x31\x03\x80\x0D\x00\x02\x20\x0D\x00\x02\xA0\x19\x00\x03\x20\x0B\x02\x82\x5F\x33\xA0\x19\x00\x04\x20\x0D\x00\x04\x20\x19\x00\xFF\x10\x00\x00\x01\x75\x2D\xA2\x90\x67\x00\x00\x00\x00\x00\x00\x00\x05\xC3\x40\x56\x40\x60\x18\x60\x00\x00\x00\x24\x00\x05\x01\x00\x01\x02\x01\x84\x69\x74\x65\x6D\x05\x85\x76\x61\x6C\x75\x65\x06\x40\x10\x00\x00\x20\x01\x06\x01\x01\x82\x5F\x35\x03\x05\x20\x1E\x40\x0B\x03\x01\x01\x06\x01\x80\x0B\x00\x02\x20\x0B\x02\x82\x5F\x37\x60\x19\x03\x01\x01\xDF\xFB\x20\x05\x00\x08\x60\x1A\x20\x0C\x00\xFC\x20\x05\x02\x82\x5F\x39\x20\x1B\x00\xFF\x0A\x81\x00\x00\x01\x75\x2D\xA2\x90\x68\x01\x00\x09\x00\x1D\x6F\xC0\x69\x8A\xDE\xF7\x92" } err
  428. assert_match "*Bad data format*" $err
  429. }
  430. }
  431. test {corrupt payload: fuzzer findings - infinite loop} {
  432. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  433. r config set sanitize-dump-payload no
  434. r debug set-skip-checksum-validation 1
  435. r RESTORE _stream 0 "\x0F\x01\x10\x00\x00\x01\x75\x3A\xA6\xD0\x93\x00\x00\x00\x00\x00\x00\x00\x00\x40\x42\x42\x00\x00\x00\x18\x00\x03\x01\x00\x01\x02\x01\x84\x69\x74\x65\x6D\x05\x85\x76\x61\x6C\x75\x65\x06\x00\x01\x02\x01\x00\x01\x00\x01\x01\x01\x00\x01\x05\x01\x02\x01\x00\x01\x01\x01\x01\x01\x82\x5F\x31\x03\xFD\x01\x02\x01\x00\x01\x02\x01\x01\x01\x02\x01\x05\x01\xFF\x03\x81\x00\x00\x01\x75\x3A\xA6\xD0\x93\x02\x01\x07\x6D\x79\x67\x72\x6F\x75\x70\x81\x00\x00\x01\x75\x3A\xA6\xD0\x93\x00\x01\x00\x00\x01\x75\x3A\xA6\xD0\x93\x00\x00\x00\x00\x00\x00\x00\x00\x94\xD0\xA6\x3A\x75\x01\x00\x00\x01\x01\x05\x41\x6C\x69\x63\x65\x94\xD0\xA6\x3A\x75\x01\x00\x00\x01\x00\x00\x01\x75\x3A\xA6\xD0\x93\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\xC4\x09\xAD\x69\x7E\xEE\xA6\x2F"
  436. catch { r XREVRANGE _stream 288270516 971031845 }
  437. assert_equal [count_log_message 0 "crashed by signal"] 0
  438. assert_equal [count_log_message 0 "ASSERTION FAILED"] 1
  439. }
  440. }
  441. test {corrupt payload: fuzzer findings - hash ziplist too long entry len} {
  442. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  443. r debug set-skip-checksum-validation 1
  444. catch {
  445. r RESTORE _hash 0 "\x0D\x3D\x3D\x00\x00\x00\x3A\x00\x00\x00\x14\x13\x00\xF5\x02\xF5\x02\xF2\x02\x53\x5F\x31\x04\xF3\x02\xF3\x02\xF7\x02\xF7\x02\xF8\x02\x02\x5F\x37\x04\xF1\x02\xF1\x02\xF6\x02\x02\x5F\x35\x04\xF4\x02\x02\x5F\x33\x04\xFA\x02\x02\x5F\x39\x04\xF9\x02\xF9\xFF\x09\x00\xB5\x48\xDE\x62\x31\xD0\xE5\x63"
  446. } err
  447. assert_match "*Bad data format*" $err
  448. verify_log_message 0 "*integrity check failed*" 0
  449. }
  450. }
  451. if {$run_oom_tests} {
  452. test {corrupt payload: OOM in rdbGenericLoadStringObject} {
  453. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  454. r config set sanitize-dump-payload no
  455. catch { r RESTORE x 0 "\x0A\x81\x7F\xFF\xFF\xFF\xFF\xFF\xFF\xFF\x13\x00\x00\x00\x0E\x00\x00\x00\x02\x00\x00\x02\x61\x00\x04\x02\x62\x00\xFF\x09\x00\x57\x04\xE5\xCD\xD4\x37\x6C\x57" } err
  456. assert_match "*Bad data format*" $err
  457. r ping
  458. }
  459. }
  460. test {corrupt payload: fuzzer findings - OOM in dictExpand} {
  461. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  462. r config set sanitize-dump-payload no
  463. r debug set-skip-checksum-validation 1
  464. catch { r RESTORE x 0 "\x02\x81\x02\x5F\x31\xC0\x00\xC0\x02\x09\x00\xCD\x84\x2C\xB7\xE8\xA4\x49\x57" } err
  465. assert_match "*Bad data format*" $err
  466. r ping
  467. }
  468. }
  469. }
  470. test {corrupt payload: fuzzer findings - invalid tail offset after removal} {
  471. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  472. r config set sanitize-dump-payload no
  473. r debug set-skip-checksum-validation 1
  474. r RESTORE _zset 0 "\x0C\x19\x19\x00\x00\x00\x02\x00\x00\x00\x06\x00\x00\xF1\x02\xF1\x02\x02\x5F\x31\x04\xF2\x02\xF3\x02\xF3\xFF\x09\x00\x4D\x72\x7B\x97\xCD\x9A\x70\xC1"
  475. catch {r ZPOPMIN _zset}
  476. catch {r ZPOPMAX _zset}
  477. assert_equal [count_log_message 0 "crashed by signal"] 0
  478. assert_equal [count_log_message 0 "ASSERTION FAILED"] 1
  479. }
  480. }
  481. test {corrupt payload: fuzzer findings - negative reply length} {
  482. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  483. r config set sanitize-dump-payload no
  484. r debug set-skip-checksum-validation 1
  485. r RESTORE _stream 0 "\x0F\x01\x10\x00\x00\x01\x75\xCF\xA1\x16\xA7\x00\x00\x00\x00\x00\x00\x00\x00\x40\x42\x42\x00\x00\x00\x18\x00\x03\x01\x00\x01\x02\x01\x84\x69\x74\x65\x6D\x05\x85\x76\x61\x6C\x75\x65\x06\x00\x01\x02\x01\x00\x01\x00\x01\x01\x01\x00\x01\x05\x01\x02\x01\x00\x01\x01\x01\x01\x01\x14\x5F\x31\x03\x05\x01\x02\x01\x00\x01\x02\x01\x01\x01\x02\x01\x05\x01\xFF\x03\x81\x00\x00\x01\x75\xCF\xA1\x16\xA7\x02\x01\x07\x6D\x79\x67\x72\x6F\x75\x70\x81\x00\x00\x01\x75\xCF\xA1\x16\xA7\x01\x01\x00\x00\x01\x75\xCF\xA1\x16\xA7\x00\x00\x00\x00\x00\x00\x00\x01\xA7\x16\xA1\xCF\x75\x01\x00\x00\x01\x01\x05\x41\x6C\x69\x63\x65\xA7\x16\xA1\xCF\x75\x01\x00\x00\x01\x00\x00\x01\x75\xCF\xA1\x16\xA7\x00\x00\x00\x00\x00\x00\x00\x01\x09\x00\x1B\x42\x52\xB8\xDD\x5C\xE5\x4E"
  486. catch {r XADD _stream * -956 -2601503852}
  487. catch {r XINFO STREAM _stream FULL}
  488. assert_equal [count_log_message 0 "crashed by signal"] 0
  489. assert_equal [count_log_message 0 "ASSERTION FAILED"] 1
  490. }
  491. }
  492. test {corrupt payload: fuzzer findings - valgrind negative malloc} {
  493. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  494. r config set sanitize-dump-payload yes
  495. r debug set-skip-checksum-validation 1
  496. catch {r RESTORE _key 0 "\x0E\x01\x81\xD6\xD6\x00\x00\x00\x0A\x00\x00\x00\x01\x00\x00\x40\xC8\x6F\x2F\x36\xE2\xDF\xE3\x2E\x26\x64\x8B\x87\xD1\x7A\xBD\xFF\xEF\xEF\x63\x65\xF6\xF8\x8C\x4E\xEC\x96\x89\x56\x88\xF8\x3D\x96\x5A\x32\xBD\xD1\x36\xD8\x02\xE6\x66\x37\xCB\x34\x34\xC4\x52\xA7\x2A\xD5\x6F\x2F\x7E\xEE\xA2\x94\xD9\xEB\xA9\x09\x38\x3B\xE1\xA9\x60\xB6\x4E\x09\x44\x1F\x70\x24\xAA\x47\xA8\x6E\x30\xE1\x13\x49\x4E\xA1\x92\xC4\x6C\xF0\x35\x83\xD9\x4F\xD9\x9C\x0A\x0D\x7A\xE7\xB1\x61\xF5\xC1\x2D\xDC\xC3\x0E\x87\xA6\x80\x15\x18\xBA\x7F\x72\xDD\x14\x75\x46\x44\x0B\xCA\x9C\x8F\x1C\x3C\xD7\xDA\x06\x62\x18\x7E\x15\x17\x24\xAB\x45\x21\x27\xC2\xBC\xBB\x86\x6E\xD8\xBD\x8E\x50\xE0\xE0\x88\xA4\x9B\x9D\x15\x2A\x98\xFF\x5E\x78\x6C\x81\xFC\xA8\xC9\xC8\xE6\x61\xC8\xD1\x4A\x7F\x81\xD6\xA6\x1A\xAD\x4C\xC1\xA2\x1C\x90\x68\x15\x2A\x8A\x36\xC0\x58\xC3\xCC\xA6\x54\x19\x12\x0F\xEB\x46\xFF\x6E\xE3\xA7\x92\xF8\xFF\x09\x00\xD0\x71\xF7\x9F\xF7\x6A\xD6\x2E"} err
  497. assert_match "*Bad data format*" $err
  498. r ping
  499. }
  500. }
  501. test {corrupt payload: fuzzer findings - valgrind invalid read} {
  502. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  503. r config set sanitize-dump-payload yes
  504. r debug set-skip-checksum-validation 1
  505. catch {r RESTORE _key 0 "\x05\x0A\x02\x5F\x39\x00\x00\x00\x00\x00\x00\x22\x40\xC0\x08\x00\x00\x00\x00\x00\x00\x20\x40\x02\x5F\x37\x00\x00\x00\x00\x00\x00\x1C\x40\xC0\x06\x00\x00\x00\x00\x00\x00\x18\x40\x02\x5F\x33\x00\x00\x00\x00\x00\x00\x14\x40\xC0\x04\x00\x00\x00\x00\x00\x00\x10\x40\x02\x5F\x33\x00\x00\x00\x00\x00\x00\x08\x40\xC0\x02\x00\x00\x00\x00\x00\x00\x00\x40\x02\x5F\x31\x00\x00\x00\x00\x00\x00\xF0\x3F\xC0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x3C\x66\xD7\x14\xA9\xDA\x3C\x69"} err
  506. assert_match "*Bad data format*" $err
  507. r ping
  508. }
  509. }
  510. test {corrupt payload: fuzzer findings - empty hash ziplist} {
  511. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  512. r config set sanitize-dump-payload yes
  513. r debug set-skip-checksum-validation 1
  514. catch {r RESTORE _int 0 "\x04\xC0\x01\x09\x00\xF6\x8A\xB6\x7A\x85\x87\x72\x4D"} err
  515. assert_match "*Bad data format*" $err
  516. r ping
  517. }
  518. }
  519. test {corrupt payload: fuzzer findings - stream with no records} {
  520. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  521. r config set sanitize-dump-payload no
  522. r debug set-skip-checksum-validation 1
  523. r restore _stream 0 "\x0F\x01\x10\x00\x00\x01\x78\x4D\x55\x68\x09\x00\x00\x00\x00\x00\x00\x00\x00\x40\x42\x42\x00\x00\x00\x18\x00\x02\x01\x01\x01\x02\x01\x84\x69\x74\x65\x6D\x05\x85\x76\x61\x6C\x75\x65\x06\x00\x01\x02\x01\x00\x01\x00\x01\x01\x01\x00\x01\x05\x01\x03\x01\x3E\x01\x00\x01\x01\x01\x82\x5F\x31\x03\x05\x01\x02\x01\x50\x01\x00\x01\x01\x01\x02\x01\x05\x23\xFF\x02\x81\x00\x00\x01\x78\x4D\x55\x68\x59\x00\x01\x07\x6D\x79\x67\x72\x6F\x75\x70\x81\x00\x00\x01\x78\x4D\x55\x68\x47\x00\x01\x00\x00\x01\x78\x4D\x55\x68\x47\x00\x00\x00\x00\x00\x00\x00\x00\x9F\x68\x55\x4D\x78\x01\x00\x00\x01\x01\x05\x41\x6C\x69\x63\x65\x85\x68\x55\x4D\x78\x01\x00\x00\x01\x00\x00\x01\x78\x4D\x55\x68\x47\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\xF1\xC0\x72\x70\x39\x40\x1E\xA9" replace
  524. catch {r XREAD STREAMS _stream $}
  525. assert_equal [count_log_message 0 "crashed by signal"] 0
  526. assert_equal [count_log_message 0 "Guru Meditation"] 1
  527. }
  528. }
  529. test {corrupt payload: fuzzer findings - quicklist ziplist tail followed by extra data which start with 0xff} {
  530. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  531. r config set sanitize-dump-payload yes
  532. r debug set-skip-checksum-validation 1
  533. catch {
  534. r restore key 0 "\x0E\x01\x11\x11\x00\x00\x00\x0A\x00\x00\x00\x01\x00\x00\xF6\xFF\xB0\x6C\x9C\xFF\x09\x00\x9C\x37\x47\x49\x4D\xDE\x94\xF5" replace
  535. } err
  536. assert_match "*Bad data format*" $err
  537. verify_log_message 0 "*integrity check failed*" 0
  538. }
  539. }
  540. test {corrupt payload: fuzzer findings - dict init to huge size} {
  541. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  542. r config set sanitize-dump-payload no
  543. r debug set-skip-checksum-validation 1
  544. catch {r restore key 0 "\x02\x81\xC0\x00\x02\x5F\x31\xC0\x02\x09\x00\xB2\x1B\xE5\x17\x2E\x15\xF4\x6C" replace} err
  545. assert_match "*Bad data format*" $err
  546. r ping
  547. }
  548. }
  549. test {corrupt payload: fuzzer findings - huge string} {
  550. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  551. r config set sanitize-dump-payload yes
  552. r debug set-skip-checksum-validation 1
  553. catch {r restore key 0 "\x00\x81\x01\x09\x00\xF6\x2B\xB6\x7A\x85\x87\x72\x4D"} err
  554. assert_match "*Bad data format*" $err
  555. r ping
  556. }
  557. }
  558. test {corrupt payload: fuzzer findings - stream PEL without consumer} {
  559. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  560. r config set sanitize-dump-payload yes
  561. r debug set-skip-checksum-validation 1
  562. catch {r restore _stream 0 "\x0F\x01\x10\x00\x00\x01\x7B\x08\xF0\xB2\x34\x00\x00\x00\x00\x00\x00\x00\x00\xC3\x3B\x40\x42\x19\x42\x00\x00\x00\x18\x00\x02\x01\x01\x01\x02\x01\x84\x69\x74\x65\x6D\x05\x85\x76\x61\x6C\x75\x65\x06\x00\x20\x10\x00\x00\x20\x01\x00\x01\x20\x03\x02\x05\x01\x03\x20\x05\x40\x00\x04\x82\x5F\x31\x03\x05\x60\x19\x80\x32\x02\x05\x01\xFF\x02\x81\x00\x00\x01\x7B\x08\xF0\xB2\x34\x02\x01\x07\x6D\x79\x67\x72\x6F\x75\x70\x81\x00\x00\x01\x7B\x08\xF0\xB2\x34\x01\x01\x00\x00\x01\x7B\x08\xF0\xB2\x34\x00\x00\x00\x00\x00\x00\x00\x01\x35\xB2\xF0\x08\x7B\x01\x00\x00\x01\x01\x13\x41\x6C\x69\x63\x65\x35\xB2\xF0\x08\x7B\x01\x00\x00\x01\x00\x00\x01\x7B\x08\xF0\xB2\x34\x00\x00\x00\x00\x00\x00\x00\x01\x09\x00\x28\x2F\xE0\xC5\x04\xBB\xA7\x31"} err
  563. assert_match "*Bad data format*" $err
  564. #catch {r XINFO STREAM _stream FULL }
  565. r ping
  566. }
  567. }
  568. test {corrupt payload: fuzzer findings - stream listpack valgrind issue} {
  569. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  570. r config set sanitize-dump-payload no
  571. r debug set-skip-checksum-validation 1
  572. r restore _stream 0 "\x0F\x01\x10\x00\x00\x01\x7B\x09\x5E\x94\xFF\x00\x00\x00\x00\x00\x00\x00\x00\x40\x42\x42\x00\x00\x00\x18\x00\x02\x01\x01\x01\x02\x01\x84\x69\x74\x65\x6D\x05\x85\x76\x61\x6C\x75\x65\x06\x00\x01\x02\x01\x00\x01\x00\x01\x01\x01\x00\x01\x05\x01\x03\x01\x25\x01\x00\x01\x01\x01\x82\x5F\x31\x03\x05\x01\x02\x01\x32\x01\x00\x01\x01\x01\x02\x01\xF0\x01\xFF\x02\x81\x00\x00\x01\x7B\x09\x5E\x95\x31\x00\x01\x07\x6D\x79\x67\x72\x6F\x75\x70\x81\x00\x00\x01\x7B\x09\x5E\x95\x24\x00\x01\x00\x00\x01\x7B\x09\x5E\x95\x24\x00\x00\x00\x00\x00\x00\x00\x00\x5C\x95\x5E\x09\x7B\x01\x00\x00\x01\x01\x05\x41\x6C\x69\x63\x65\x4B\x95\x5E\x09\x7B\x01\x00\x00\x01\x00\x00\x01\x7B\x09\x5E\x95\x24\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\x19\x29\x94\xDF\x76\xF8\x1A\xC6"
  573. catch {r XINFO STREAM _stream FULL }
  574. assert_equal [count_log_message 0 "crashed by signal"] 0
  575. assert_equal [count_log_message 0 "ASSERTION FAILED"] 1
  576. }
  577. }
  578. test {corrupt payload: fuzzer findings - stream with bad lpFirst} {
  579. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  580. r config set sanitize-dump-payload yes
  581. r debug set-skip-checksum-validation 1
  582. catch {r restore _stream 0 "\x0F\x01\x10\x00\x00\x01\x7B\x0E\x52\xD2\xEC\x00\x00\x00\x00\x00\x00\x00\x00\x40\x42\x42\x00\x00\x00\x18\x00\x02\xF7\x01\x01\x02\x01\x84\x69\x74\x65\x6D\x05\x85\x76\x61\x6C\x75\x65\x06\x00\x01\x02\x01\x00\x01\x00\x01\x01\x01\x00\x01\x05\x01\x03\x01\x01\x01\x00\x01\x01\x01\x82\x5F\x31\x03\x05\x01\x02\x01\x01\x01\x01\x01\x01\x01\x02\x01\x05\x01\xFF\x02\x81\x00\x00\x01\x7B\x0E\x52\xD2\xED\x01\x01\x07\x6D\x79\x67\x72\x6F\x75\x70\x81\x00\x00\x01\x7B\x0E\x52\xD2\xED\x00\x01\x00\x00\x01\x7B\x0E\x52\xD2\xED\x00\x00\x00\x00\x00\x00\x00\x00\xED\xD2\x52\x0E\x7B\x01\x00\x00\x01\x01\x05\x41\x6C\x69\x63\x65\xED\xD2\x52\x0E\x7B\x01\x00\x00\x01\x00\x00\x01\x7B\x0E\x52\xD2\xED\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\xAC\x05\xC9\x97\x5D\x45\x80\xB3"} err
  583. assert_match "*Bad data format*" $err
  584. r ping
  585. }
  586. }
  587. test {corrupt payload: fuzzer findings - stream listpack lpPrev valgrind issue} {
  588. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  589. r config set sanitize-dump-payload no
  590. r debug set-skip-checksum-validation 1
  591. r restore _stream 0 "\x0F\x01\x10\x00\x00\x01\x7B\x0E\xAE\x66\x36\x00\x00\x00\x00\x00\x00\x00\x00\x40\x42\x42\x00\x00\x00\x18\x00\x02\x01\x01\x01\x02\x01\x84\x69\x74\x65\x6D\x05\x85\x76\x61\x6C\x75\x65\x06\x00\x01\x02\x01\x00\x01\x00\x01\x01\x01\x00\x01\x1D\x01\x03\x01\x24\x01\x00\x01\x01\x69\x82\x5F\x31\x03\x05\x01\x02\x01\x33\x01\x00\x01\x01\x01\x02\x01\x05\x01\xFF\x02\x81\x00\x00\x01\x7B\x0E\xAE\x66\x69\x00\x01\x07\x6D\x79\x67\x72\x6F\x75\x70\x81\x00\x00\x01\x7B\x0E\xAE\x66\x5A\x00\x01\x00\x00\x01\x7B\x0E\xAE\x66\x5A\x00\x00\x00\x00\x00\x00\x00\x00\x94\x66\xAE\x0E\x7B\x01\x00\x00\x01\x01\x05\x41\x6C\x69\x63\x65\x83\x66\xAE\x0E\x7B\x01\x00\x00\x01\x00\x00\x01\x7B\x0E\xAE\x66\x5A\x00\x00\x00\x00\x00\x00\x00\x00\x09\x00\xD5\xD7\xA5\x5C\x63\x1C\x09\x40"
  592. catch {r XREVRANGE _stream 1618622681 606195012389}
  593. assert_equal [count_log_message 0 "crashed by signal"] 0
  594. assert_equal [count_log_message 0 "ASSERTION FAILED"] 1
  595. }
  596. }
  597. test {corrupt payload: fuzzer findings - stream with non-integer entry id} {
  598. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  599. r config set sanitize-dump-payload yes
  600. r debug set-skip-checksum-validation 1
  601. catch {r restore _streambig 0 "\x0F\x03\x10\x00\x00\x01\x7B\x13\x34\xC3\xB2\x00\x00\x00\x00\x00\x00\x00\x00\xC3\x40\x4F\x40\x5C\x18\x5C\x00\x00\x00\x24\x00\x05\x01\x00\x01\x02\x01\x84\x69\x74\x65\x6D\x05\x85\x76\x61\x6C\x75\x65\x06\x40\x10\x00\x80\x20\x01\x00\x01\x20\x03\x00\x05\x20\x1C\x40\x09\x05\x01\x01\x82\x5F\x31\x03\x80\x0D\x00\x02\x20\x0D\x00\x02\xA0\x19\x00\x03\x20\x0B\x02\x82\x5F\x33\xA0\x19\x00\x04\x20\x0D\x00\x04\x20\x19\x00\xFF\x10\x00\x00\x01\x7B\x13\x34\xC3\xB2\x00\x00\x00\x00\x00\x00\x00\x05\xC3\x40\x56\x40\x61\x18\x61\x00\x00\x00\x24\x00\x05\x01\x00\x01\x02\x01\x84\x69\x74\x65\x6D\x05\x85\x76\x61\x6C\x75\x65\x06\x40\x10\x00\x00\x20\x01\x06\x01\x01\x82\x5F\x35\x03\x05\x20\x1E\x40\x0B\x03\x01\x01\x06\x01\x40\x0B\x03\x01\x01\xDF\xFB\x20\x05\x02\x82\x5F\x37\x60\x1A\x20\x0E\x00\xFC\x20\x05\x00\x08\xC0\x1B\x00\xFD\x20\x0C\x02\x82\x5F\x39\x20\x1B\x00\xFF\x10\x00\x00\x01\x7B\x13\x34\xC3\xB3\x00\x00\x00\x00\x00\x00\x00\x03\xC3\x3D\x40\x4A\x18\x4A\x00\x00\x00\x15\x00\x02\x01\x00\x01\x02\x01\x84\x69\x74\x65\x6D\x05\x85\x76\x61\x6C\x75\x65\x06\x40\x10\x00\x00\x20\x01\x40\x00\x00\x05\x60\x07\x02\xDF\xFD\x02\xC0\x23\x09\x01\x01\x86\x75\x6E\x69\x71\x75\x65\x07\xA0\x2D\x02\x08\x01\xFF\x0C\x81\x00\x00\x01\x7B\x13\x34\xC3\xB4\x00\x00\x09\x00\x9D\xBD\xD5\xB9\x33\xC4\xC5\xFF"} err
  602. #catch {r XINFO STREAM _streambig FULL }
  603. assert_match "*Bad data format*" $err
  604. r ping
  605. }
  606. }
  607. test {corrupt payload: fuzzer findings - empty quicklist} {
  608. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  609. r config set sanitize-dump-payload yes
  610. r debug set-skip-checksum-validation 1
  611. catch {
  612. r restore key 0 "\x0E\xC0\x2B\x15\x00\x00\x00\x0A\x00\x00\x00\x01\x00\x00\xE0\x62\x58\xEA\xDF\x22\x00\x00\x00\xFF\x09\x00\xDF\x35\xD2\x67\xDC\x0E\x89\xAB" replace
  613. } err
  614. assert_match "*Bad data format*" $err
  615. r ping
  616. }
  617. }
  618. test {corrupt payload: fuzzer findings - empty zset} {
  619. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  620. r config set sanitize-dump-payload yes
  621. r debug set-skip-checksum-validation 1
  622. catch {r restore key 0 "\x05\xC0\x01\x09\x00\xF6\x8A\xB6\x7A\x85\x87\x72\x4D"} err
  623. assert_match "*Bad data format*" $err
  624. r ping
  625. }
  626. }
  627. test {corrupt payload: fuzzer findings - hash with len of 0} {
  628. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  629. r config set sanitize-dump-payload yes
  630. r debug set-skip-checksum-validation 1
  631. catch {r restore key 0 "\x04\xC0\x21\x09\x00\xF6\x8A\xB6\x7A\x85\x87\x72\x4D"} err
  632. assert_match "*Bad data format*" $err
  633. r ping
  634. }
  635. }
  636. test {corrupt payload: fuzzer findings - hash listpack first element too long entry len} {
  637. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  638. r debug set-skip-checksum-validation 1
  639. r config set sanitize-dump-payload yes
  640. catch { r restore _hash 0 "\x10\x15\x15\x00\x00\x00\x06\x00\xF0\x01\x00\x01\x01\x01\x82\x5F\x31\x03\x02\x01\x02\x01\xFF\x0A\x00\x94\x21\x0A\xFA\x06\x52\x9F\x44" replace } err
  641. assert_match "*Bad data format*" $err
  642. verify_log_message 0 "*integrity check failed*" 0
  643. }
  644. }
  645. test {corrupt payload: fuzzer findings - stream double free listpack when insert dup node to rax returns 0} {
  646. start_server [list overrides [list loglevel verbose use-exit-on-panic yes crash-memcheck-enabled no] ] {
  647. r debug set-skip-checksum-validation 1
  648. r config set sanitize-dump-payload yes
  649. catch { r restore _stream 0 "\x0F\x03\x10\x00\x00\x01\x7B\x60\x5A\x23\x79\x00\x00\x00\x00\x00\x00\x00\x00\xC3\x40\x4F\x40\x5C\x18\x5C\x00\x00\x00\x24\x00\x05\x01\x00\x01\x02\x01\x84\x69\x74\x65\x6D\x05\x85\x76\x61\x6C\x75\x65\x06\x40\x10\x00\x00\x20\x01\x00\x01\x20\x03\x00\x05\x20\x1C\x40\x09\x05\x01\x01\x82\x5F\x31\x03\x80\x0D\x00\x02\x20\x0D\x00\x02\xA0\x19\x00\x03\x20\x0B\x02\x82\x5F\x33\xA0\x19\x00\x04\x20\x0D\x00\x04\x20\x19\x00\xFF\x10\x00\x00\x01\x7B\x60\x5A\x23\x79\x00\x00\x00\x00\x00\x00\x00\x05\xC3\x40\x51\x40\x5E\x18\x5E\x00\x00\x00\x24\x00\x05\x01\x00\x01\x02\x01\x84\x69\x74\x65\x6D\x05\x85\x76\x61\x6C\x75\x65\x06\x40\x10\x00\x00\x20\x01\x06\x01\x01\x82\x5F\x35\x03\x05\x20\x1E\x40\x0B\x03\x01\x01\x06\x01\x80\x0B\x00\x02\x20\x0B\x02\x82\x5F\x37\xA0\x19\x00\x03\x20\x0D\x00\x08\xA0\x19\x00\x04\x20\x0B\x02\x82\x5F\x39\x20\x19\x00\xFF\x10\x00\x00\x01\x7B\x60\x5A\x23\x79\x00\x00\x00\x00\x00\x00\x00\x00\xC3\x3B\x40\x49\x18\x49\x00\x00\x00\x15\x00\x02\x01\x00\x01\x02\x01\x84\x69\x74\x65\x6D\x05\x85\x76\x61\x6C\x75\x65\x06\x40\x10\x00\x00\x20\x01\x40\x00\x00\x05\x20\x07\x40\x09\xC0\x22\x09\x01\x01\x86\x75\x6E\x69\x71\x75\x65\x07\xA0\x2C\x02\x08\x01\xFF\x0C\x81\x00\x00\x01\x7B\x60\x5A\x23\x7A\x01\x00\x0A\x00\x9C\x8F\x1E\xBF\x2E\x05\x59\x09" replace } err
  650. assert_match "*Bad data format*" $err
  651. r ping
  652. }
  653. }
  654. } ;# tags