Use fixed position keys parameter for MSETEX command#9
Conversation
Co-authored-by: Yuan Wang <yuan.wang@redis.com>
Co-authored-by: Yuan Wang <yuan.wang@redis.com>
WalkthroughThe MSETEX command argument structure has been refactored from a keyword-based "KEYS" block approach to use an explicit numeric Changes
Estimated code review effort🎯 4 (Complex) | ⏱️ ~50 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
Comment |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@src/t_string.c`:
- Around line 718-727: The current guard multiplies kv_count * 2 before
validating, which can overflow; change the validation to check kv_count against
a division-based bound (e.g., if (kv_count > (c->argc - 2) / 2) ) and only
compute the start index (kv_count * 2 + 2) after this check; update the error
path that calls addReplyError to use that new guard and then call
parseExtendedStringArgumentsOrReply(c, kv_count * 2 + 2, &args, COMMAND_MSETEX)
only after validation so parseExtendedStringArgumentsOrReply and subsequent
loops (which index c->argv) cannot run with an overflowed value.
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (4)
src/commands.defsrc/commands/msetex.jsonsrc/t_string.ctests/unit/type/string.tcl
🧰 Additional context used
🧬 Code graph analysis (1)
src/t_string.c (3)
src/object.c (2)
getRangeLongFromObjectOrReply(1152-1163)decrRefCount(594-618)src/networking.c (2)
addReplyError(644-647)rewriteClientCommandArgument(4424-4477)src/db.c (1)
lookupKeyRead(311-313)
🔇 Additional comments (4)
src/commands.def (4)
11143-11145: Key-spec stride matches key/value pairs.Using
FK_KEYNUMwith step2aligns with the key/value layout afternumkeys.
11148-11152: Data block subargs are well-formed.The key/value pair structure is clear and consistent with
MSET/MSETNX.
11169-11172: Args ordering reflects the fixed-position design.
numkeysfollowed by the data block cleanly encodes the new schema.
11769-11769: Arity update aligns with the new minimum.
-4matchesnumkeys + key + valueas the minimum argument set.
✏️ Tip: You can disable this entire section by setting review_details to false in your review settings.
| /* Validate we have enough arguments: command + numkeys + (key-value pairs) * 2 | ||
| * Be careful to avoid overflow when calculating kv_count * 2 */ | ||
| if (kv_count * 2 + 2 > c->argc) { | ||
| addReplyError(c, "wrong number of key-value pairs"); | ||
| return; | ||
| } | ||
|
|
||
| /* Validate KEYS block was found */ | ||
| if (args.kv_count == 0) { | ||
| addReplyError(c, "syntax error - KEYS keyword is required"); | ||
| extendedStringArgs args; | ||
| if (parseExtendedStringArgumentsOrReply(c, kv_count * 2 + 2, &args, COMMAND_MSETEX) != C_OK) { | ||
| return; |
There was a problem hiding this comment.
Prevent kv_count overflow before multiplying.
At Line 718-721 the guard multiplies kv_count * 2 before validating it. On 32‑bit builds, kv_count near INT_MAX can overflow, the check fails, and the loops at Line 738+ can index c->argv out of bounds. Use a division-based bound and compute the start index only after validation.
🛠️ Proposed fix
- if (kv_count * 2 + 2 > c->argc) {
+ if (kv_count > (c->argc - 2) / 2) {
addReplyError(c, "wrong number of key-value pairs");
return;
}
- extendedStringArgs args;
- if (parseExtendedStringArgumentsOrReply(c, kv_count * 2 + 2, &args, COMMAND_MSETEX) != C_OK) {
+ int args_start = (int)(kv_count * 2 + 2);
+ extendedStringArgs args;
+ if (parseExtendedStringArgumentsOrReply(c, args_start, &args, COMMAND_MSETEX) != C_OK) {
return;
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| /* Validate we have enough arguments: command + numkeys + (key-value pairs) * 2 | |
| * Be careful to avoid overflow when calculating kv_count * 2 */ | |
| if (kv_count * 2 + 2 > c->argc) { | |
| addReplyError(c, "wrong number of key-value pairs"); | |
| return; | |
| } | |
| /* Validate KEYS block was found */ | |
| if (args.kv_count == 0) { | |
| addReplyError(c, "syntax error - KEYS keyword is required"); | |
| extendedStringArgs args; | |
| if (parseExtendedStringArgumentsOrReply(c, kv_count * 2 + 2, &args, COMMAND_MSETEX) != C_OK) { | |
| return; | |
| /* Validate we have enough arguments: command + numkeys + (key-value pairs) * 2 | |
| * Be careful to avoid overflow when calculating kv_count * 2 */ | |
| if (kv_count > (c->argc - 2) / 2) { | |
| addReplyError(c, "wrong number of key-value pairs"); | |
| return; | |
| } | |
| int args_start = (int)(kv_count * 2 + 2); | |
| extendedStringArgs args; | |
| if (parseExtendedStringArgumentsOrReply(c, args_start, &args, COMMAND_MSETEX) != C_OK) { | |
| return; |
🤖 Prompt for AI Agents
In `@src/t_string.c` around lines 718 - 727, The current guard multiplies kv_count
* 2 before validating, which can overflow; change the validation to check
kv_count against a division-based bound (e.g., if (kv_count > (c->argc - 2) / 2)
) and only compute the start index (kv_count * 2 + 2) after this check; update
the error path that calls addReplyError to use that new guard and then call
parseExtendedStringArgumentsOrReply(c, kv_count * 2 + 2, &args, COMMAND_MSETEX)
only after validation so parseExtendedStringArgumentsOrReply and subsequent
loops (which index c->argv) cannot run with an overflowed value.
Benchmark PR from qodo-benchmark#32
Summary by CodeRabbit
numkeysparameter as the first argument, followed by key-value pairs and optional condition/expiration flags (NX/XX, EX/PX/EXAT/PXAT/KEEPTTL).✏️ Tip: You can customize this high-level summary in your review settings.