CVE-2021-32765

Hiredis is a minimalistic C client library for the Redis database. In affected versions Hiredis is vulnurable to integer overflow if provided maliciously crafted or corrupted RESP mult-bulk protocol data. When parsing multi-bulk (array-like) replies, hiredis fails to check if count * sizeof(redisReply*) can be represented in SIZE_MAX. If it can not, and the calloc() call doesn't itself make this check, it would result in a short allocation and subsequent buffer overflow. Users of hiredis who are unable to update may set the maxelements context option to a value small enough that no overflow is possible.

References

Affected packages

Git / github.com/redis/hiredis

Affected ranges

Type: GIT
Repo: https://github.com/redis/hiredis
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

76a7b10005c70babee357a7d0f2becf28ec7ed1e

Affected versions

v0.*

v0.0.1

v0.10.0

v0.10.1

v0.11.0

v0.12.0

v0.12.1

v0.13.0

v0.13.1

v0.13.2

v0.13.3

v0.14.0

v0.9.0

v0.9.1

v0.9.2

v1.*

v1.0.0

v1.0.0-rc1

Database specific

{
    "vanir_signatures": [
        {
            "id": "CVE-2021-32765-28fc1741",
            "digest": {
                "line_hashes": [
                    "2960801188689279389740907912361228292",
                    "103680156091366763705168315892522468615",
                    "313519843436751110082004899014515685551"
                ],
                "threshold": 0.9
            },
            "signature_type": "Line",
            "target": {
                "file": "test.c"
            },
            "deprecated": false,
            "signature_version": "v1",
            "source": "https://github.com/redis/hiredis/commit/76a7b10005c70babee357a7d0f2becf28ec7ed1e"
        },
        {
            "id": "CVE-2021-32765-39e6d2f9",
            "digest": {
                "length": 581.0,
                "function_hash": "179161735348210698687051920573265359593"
            },
            "signature_type": "Function",
            "target": {
                "file": "hiredis.c",
                "function": "createArrayObject"
            },
            "deprecated": false,
            "signature_version": "v1",
            "source": "https://github.com/redis/hiredis/commit/76a7b10005c70babee357a7d0f2becf28ec7ed1e"
        },
        {
            "id": "CVE-2021-32765-40ddc6e5",
            "digest": {
                "line_hashes": [
                    "311195162694762926584360255253075821286",
                    "34398200280396169294640070927249867179",
                    "76188935927609120202871962455023382498",
                    "186027357458498207079532665570846242970"
                ],
                "threshold": 0.9
            },
            "signature_type": "Line",
            "target": {
                "file": "hiredis.c"
            },
            "deprecated": false,
            "signature_version": "v1",
            "source": "https://github.com/redis/hiredis/commit/76a7b10005c70babee357a7d0f2becf28ec7ed1e"
        },
        {
            "id": "CVE-2021-32765-b253503e",
            "digest": {
                "length": 6546.0,
                "function_hash": "160136926384499477379751229509923238067"
            },
            "signature_type": "Function",
            "target": {
                "file": "test.c",
                "function": "test_reply_reader"
            },
            "deprecated": false,
            "signature_version": "v1",
            "source": "https://github.com/redis/hiredis/commit/76a7b10005c70babee357a7d0f2becf28ec7ed1e"
        }
    ]
}