redis: Fix CVE-2025-46817

Upstream-Status: Backport from fc282edb61

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>

meta-oe/recipes-extended/redis/redis-7.0.13/CVE-2025-46817.patch

@@ -0,0 +1,101 @@
+From fc282edb61b56e7fe1e6bacf9400252145852fdc Mon Sep 17 00:00:00 2001
+From: Ozan Tezcan <ozantezcan@gmail.com>
+Date: Mon, 23 Jun 2025 13:33:00 +0300
+Subject: [PATCH] Lua script may lead to integer overflow and potential RCE
+ (CVE-2025-46817)
+
+Upstream-Status: Backport [https://github.com/redis/redis/commit/fc282edb61b56e7fe1e6bacf9400252145852fdc]
+CVE: CVE-2025-46817
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ deps/lua/src/lbaselib.c  |  7 ++++---
+ deps/lua/src/ltable.c    |  3 +--
+ tests/unit/scripting.tcl | 39 +++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 44 insertions(+), 5 deletions(-)
+
+diff --git a/deps/lua/src/lbaselib.c b/deps/lua/src/lbaselib.c
+index 2ab550bd48d..26172d15b40 100644
+--- a/deps/lua/src/lbaselib.c
++++ b/deps/lua/src/lbaselib.c
+@@ -340,13 +340,14 @@ static int luaB_assert (lua_State *L) {
+ 
+ 
+ static int luaB_unpack (lua_State *L) {
+-  int i, e, n;
++  int i, e;
++  unsigned int n;
+   luaL_checktype(L, 1, LUA_TTABLE);
+   i = luaL_optint(L, 2, 1);
+   e = luaL_opt(L, luaL_checkint, 3, luaL_getn(L, 1));
+   if (i > e) return 0;  /* empty range */
+-  n = e - i + 1;  /* number of elements */
+-  if (n <= 0 || !lua_checkstack(L, n))  /* n <= 0 means arith. overflow */
++  n = (unsigned int)e - (unsigned int)i;  /* number of elements minus 1 */
++  if (n >= INT_MAX || !lua_checkstack(L, ++n))
+     return luaL_error(L, "too many results to unpack");
+   lua_rawgeti(L, 1, i);  /* push arg[i] (avoiding overflow problems) */
+   while (i++ < e)  /* push arg[i + 1...e] */
+diff --git a/deps/lua/src/ltable.c b/deps/lua/src/ltable.c
+index f75fe19fe39..55575a8ace9 100644
+--- a/deps/lua/src/ltable.c
++++ b/deps/lua/src/ltable.c
+@@ -434,8 +434,7 @@ static TValue *newkey (lua_State *L, Table *t, const TValue *key) {
+ ** search function for integers
+ */
+ const TValue *luaH_getnum (Table *t, int key) {
+-  /* (1 <= key && key <= t->sizearray) */
+-  if (cast(unsigned int, key-1) < cast(unsigned int, t->sizearray))
++  if (1 <= key && key <= t->sizearray)
+     return &t->array[key-1];
+   else {
+     lua_Number nk = cast_num(key);
+diff --git a/tests/unit/scripting.tcl b/tests/unit/scripting.tcl
+index 333cc2692de..d45c63ceec3 100644
+--- a/tests/unit/scripting.tcl
++++ b/tests/unit/scripting.tcl
+@@ -315,6 +315,45 @@ start_server {tags {"scripting"}} {
+         set e
+     } {*against a key*}
+ 
++    test {EVAL - Test table unpack with invalid indexes} {
++        catch {run_script { return {unpack({1,2,3}, -2, 2147483647)} } 0} e
++        assert_match {*too many results to unpack*} $e
++        catch {run_script { return {unpack({1,2,3}, 0, 2147483647)} } 0} e
++        assert_match {*too many results to unpack*} $e
++        catch {run_script { return {unpack({1,2,3}, -2147483648, -2)} } 0} e
++        assert_match {*too many results to unpack*} $e
++        set res [run_script { return {unpack({1,2,3}, -1, -2)} } 0]
++        assert_match {} $res
++        set res [run_script { return {unpack({1,2,3}, 1, -1)} } 0]
++        assert_match {} $res
++
++        # unpack with range -1 to 5, verify nil indexes
++        set res [run_script {
++             local function unpack_to_list(t, i, j)
++               local n, v = select('#', unpack(t, i, j)), {unpack(t, i, j)}
++               for i = 1, n do v[i] = v[i] or '_NIL_' end
++               v.n = n
++               return v
++             end
++
++            return unpack_to_list({1,2,3}, -1, 5)
++        } 0]
++        assert_match {_NIL_ _NIL_ 1 2 3 _NIL_ _NIL_} $res
++
++        # unpack with negative range, verify nil indexes
++        set res [run_script {
++             local function unpack_to_list(t, i, j)
++               local n, v = select('#', unpack(t, i, j)), {unpack(t, i, j)}
++               for i = 1, n do v[i] = v[i] or '_NIL_' end
++               v.n = n
++               return v
++             end
++
++            return unpack_to_list({1,2,3}, -2147483648, -2147483646)
++        } 0]
++        assert_match {_NIL_ _NIL_ _NIL_} $res
++    } {}
++
+     test {EVAL - JSON numeric decoding} {
+         # We must return the table as a string because otherwise
+         # Redis converts floats to ints and we get 0 and 1023 instead

meta-oe/recipes-extended/redis/redis_7.0.13.bb

@@ -27,6 +27,7 @@ SRC_URI = "http://download.redis.io/releases/${BP}.tar.gz \
            file://CVE-2025-27151.patch \
            file://CVE-2025-32023.patch \
            file://CVE-2025-48367.patch \
+           file://CVE-2025-46817.patch \
            "
 SRC_URI[sha256sum] = "97065774d5fb8388eb0d8913458decfcb167d356e40d31dd01cd30c1cc391673"