`ZDIFFSTORE` and `ZINTERSTORE` with numkeys 0 crash the server (SIGSEGV)

Open
  • Is something wrong?
#3,729 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@siddiqueirshad is already working on this.

Since Oct 28, 2026.

  • #3731 by @siddiqueirshad — open
  • #3738 by @Anurag-S1ngh — open

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
35/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Stale
Tech stack
cpp, redis
Domain
backend, databases

Research direction

Start with CommandZDiffStore::Parse and CommandZUnionStore::Parse in src/commands/cmd_zset.cc, then compare their numkeys validation with CommandZDiff::Parse and CommandZInter. Add coverage for zero numkeys to the relevant command tests and confirm both store commands return errors without crashing. Pull request #3731 is already open for this issue.

Written by the indexing model from the issue text.

Description

bug
Search before asking
  • I had searched in the issues and found no similar issues.
Version

Kvrocks 2.17.0 (commit 185d4221), Docker image apache/kvrocks:2.17.0 (same as latest), Linux
x86_64. The code involved is unchanged on unstable.

Minimal reproduce step
docker run -d --name kvrocks -p 6666:6666 apache/kvrocks:2.17.0
redis-cli -p 6666 ZADD s 1 a
redis-cli -p 6666 ZDIFFSTORE dst 0 s                 # server crashes
redis-cli -p 6666 ZINTERSTORE dst 0 AGGREGATE SUM    # same, after the restart
What did you expect to see?

An error reply. The read-only commands already reject numkeys 0 (ZDIFF 0 s answers
ERR value is out of range, must be positive, ZINTER 0 s answers ERR out of numeric range),
and Redis answers ERR at least 1 input key is needed for 'zdiffstore' command.

What did you see instead?

The server process dies and every client loses its connection:

Ooops! Apache Kvrocks version 2.17.0 (commit 185d4221) got signal: Segmentation fault (11)
#2  ComposeNamespaceKey(rocksdb::Slice const&, rocksdb::Slice const&, bool)
#3  redis::Database::AppendNamespacePrefix(rocksdb::Slice const&)
#4  redis::ZSet::RangeByScore(...)
#5  redis::ZSet::Diff(...)
#6  redis::ZSet::DiffStore(...)
#7  redis::CommandZDiffStore::Execute(...)
Anything Else?

Potential cause. CommandZDiffStore::Parse (src/commands/cmd_zset.cc:1524-1538) and
CommandZUnionStore::Parse (:1200-1216, which ZINTERSTORE inherits) accept numkeys 0 and leave
the key list empty. ZSet::Diff then reads keys[0] (src/types/redis_zset.cc:905) and
ZSet::Inter reads keys_weights[0] (:657).

Suggested fix. Reject numkeys below 1 in both parsers, as CommandZDiff::Parse (:1472) and
CommandZInter (:1127) already do.

Are you willing to submit a PR?
  • I'm willing to submit a PR!
Dominant language
C++
Stars
4.5k
Forks
686
Avg merge
2d 13h
Merged PRs (30d)
40

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

  • Ships a Dockerfile or Docker Compose file
  • No pull request template
  • No contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from apache/kvrocks

All issues in apache/kvrocks

Similar issues

More C++ issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.