Fixed ZINCR Nan bugs leading to server crash and added tests

diff --git a/redis.c b/redis.c
index 639b71df1c7dfcbb55a3174ed5498401f9c7fa74..6bfbb84debfd9eae4ab85b95e28c62812d80c201 100644 (file)
--- a/redis.c
+++ b/redis.c
@@ -5734,6 +5734,11 @@ static void zaddGenericCommand(redisClient *c, robj *key, robj *ele, double scor
     zset *zs;
     double *score;
 
     zset *zs;
     double *score;
 

+    if (isnan(scoreval)) {
+        addReplySds(c,sdsnew("-ERR provide score is Not A Number (nan)\r\n"));
+        return;
+    }
+

     zsetobj = lookupKeyWrite(c->db,key);
     if (zsetobj == NULL) {
         zsetobj = createZsetObject();
     zsetobj = lookupKeyWrite(c->db,key);
     if (zsetobj == NULL) {
         zsetobj = createZsetObject();


@@ -5762,6 +5767,15 @@ static void zaddGenericCommand(redisClient *c, robj *key, robj *ele, double scor
         } else {
             *score = scoreval;
         }
         } else {
             *score = scoreval;
         }

+        if (isnan(*score)) {
+            addReplySds(c,
+                sdsnew("-ERR resulting score is Not A Number (nan)\r\n"));
+            zfree(score);
+            /* Note that we don't need to check if the zset may be empty and
+             * should be removed here, as we can only obtain Nan as score if
+             * there was already an element in the sorted set. */
+            return;
+        }

     } else {
         *score = scoreval;
     }
     } else {
         *score = scoreval;
     }

diff --git a/tests/unit/type/zset.tcl b/tests/unit/type/zset.tcl
index cb78515d556464066e9f0823ab4936bc84159d87..9eb61f256f5f8f45275bb928c40912c3976e5a6a 100644 (file)
--- a/tests/unit/type/zset.tcl
+++ b/tests/unit/type/zset.tcl
@@ -397,4 +397,23 @@ start_server default.conf {} {
         }
         set _ $err
     } {}
         }
         set _ $err
     } {}

+
+    test {ZSET element can't be set to nan with ZADD} {
+        set e {}
+        catch {r zadd myzset nan abc} e
+        set _ $e
+    } {*Not A Number*}
+
+    test {ZSET element can't be set to nan with ZINCRBY} {
+        set e {}
+        catch {r zincrby myzset nan abc} e
+        set _ $e
+    } {*Not A Number*}
+
+    test {ZINCRBY calls leading to Nan are refused} {
+        set e {}
+        r zincrby myzset +inf abc
+        catch {r zincrby myzset -inf abc} e
+        set _ $e
+    } {*Not A Number*}

 }
 }