Merge pull request #7375 from hwware/lcs_crash_fix

Fix Server Crash in LCS Command

src/t_string.c

@@ -516,13 +516,13 @@ void stralgoLCS(client *c) {
             withmatchlen = 1;
         } else if (!strcasecmp(opt,"MINMATCHLEN") && moreargs) {
             if (getLongLongFromObjectOrReply(c,c->argv[j+1],&minmatchlen,NULL)
-                != C_OK) return;
+                != C_OK) goto clean_up_obj;
             if (minmatchlen < 0) minmatchlen = 0;
             j++;
         } else if (!strcasecmp(opt,"STRINGS") && moreargs > 1) {
             if (a != NULL) {
                 addReplyError(c,"Either use STRINGS or KEYS");
-                return;
+                goto clean_up_obj;
             }
             a = c->argv[j+1]->ptr;
             b = c->argv[j+2]->ptr;
@@ -530,10 +530,14 @@ void stralgoLCS(client *c) {
         } else if (!strcasecmp(opt,"KEYS") && moreargs > 1) {
             if (a != NULL) {
                 addReplyError(c,"Either use STRINGS or KEYS");
-                return;
+                goto clean_up_obj;
             }
             obja = lookupKeyRead(c->db,c->argv[j+1]);
             objb = lookupKeyRead(c->db,c->argv[j+2]);
+            if ( !(obja->type == OBJ_STRING) || !(objb->type == OBJ_STRING) ) {
+                addReplyError(c,"Object associate with KEYS option should only be string type");
+                goto clean_up_obj;
+            }
             obja = obja ? getDecodedObject(obja) : createStringObject("",0);
             objb = objb ? getDecodedObject(objb) : createStringObject("",0);
             a = obja->ptr;
@@ -541,7 +545,7 @@ void stralgoLCS(client *c) {
             j += 2;
         } else {
             addReply(c,shared.syntaxerr);
-            return;
+            goto clean_up_obj;
         }
     }
 
@@ -549,12 +553,12 @@ void stralgoLCS(client *c) {
     if (a == NULL) {
         addReplyError(c,"Please specify two strings: "
                         "STRINGS or KEYS options are mandatory");
-        return;
+        goto clean_up_obj;
     } else if (getlen && getidx) {
         addReplyError(c,
             "If you want both the length and indexes, please "
             "just use IDX.");
-        return;
+        goto clean_up_obj;
     }
 
     /* Compute the LCS using the vanilla dynamic programming technique of
@@ -689,10 +693,12 @@ void stralgoLCS(client *c) {
     }
 
     /* Cleanup. */
-    if (obja) decrRefCount(obja);
-    if (objb) decrRefCount(objb);
     sdsfree(result);
     zfree(lcs);
+
+clean_up_obj:
+    if (obja) decrRefCount(obja);
+    if (objb) decrRefCount(objb);
     return;
 }