rlm_redis: error if too many args given

diff --git a/src/modules/rlm_redis/rlm_redis.c b/src/modules/rlm_redis/rlm_redis.c
index 00a0b665f387bdc2c54c7298c4299bc40e3e2ade..4990e477880957e01d76fd68dda13074f3c7f823 100644 (file)
--- a/src/modules/rlm_redis/rlm_redis.c
+++ b/src/modules/rlm_redis/rlm_redis.c
@@ -209,9 +209,14 @@ static ssize_t redis_xlat(UNUSED TALLOC_CTX *ctx, char **out, size_t outlen,
                argc = rad_expand_xlat(request, p, MAX_REDIS_ARGS, argv, false, sizeof(argv_buf), argv_buf);
                if (argc <= 0) {
                        RPEDEBUG("Invalid command: %s", p);
+               arg_error:
                        fr_pool_connection_release(pool, request, conn);
                        return -1;
                }
+               if (argc >= (MAX_REDIS_ARGS - 1)) {
+                       RPEDEBUG("Too many parameters; increase MAX_REDIS_ARGS and recompile: %s", p);
+                       goto arg_error;
+               }
 
                RDEBUG2("Executing command: %s", argv[0]);
                if (argc > 1) {
@@ -258,6 +263,12 @@ static ssize_t redis_xlat(UNUSED TALLOC_CTX *ctx, char **out, size_t outlen,
                goto finish;
        }
 
+       if (argc >= (MAX_REDIS_ARGS - 1)) {
+               RPEDEBUG("Too many parameters; increase MAX_REDIS_ARGS and recompile: %s", p);
+               ret = -1;
+               goto finish;
+       }
+
        /*
         *      If we've got multiple arguments, the second one is usually the key.
         *      The Redis docs say commands should be analysed first to get key