Fixed ZINCR Nan bugs leading to server crash and added tests

redis.c

@@ -5734,6 +5734,11 @@ static void zaddGenericCommand(redisClient *c, robj *key, robj *ele, double scor
     zset *zs;
     double *score;
 
+    if (isnan(scoreval)) {
+        addReplySds(c,sdsnew("-ERR provide score is Not A Number (nan)\r\n"));
+        return;
+    }
+
     zsetobj = lookupKeyWrite(c->db,key);
     if (zsetobj == NULL) {
         zsetobj = createZsetObject();
@@ -5762,6 +5767,15 @@ static void zaddGenericCommand(redisClient *c, robj *key, robj *ele, double scor
         } else {
             *score = scoreval;
         }
+        if (isnan(*score)) {
+            addReplySds(c,
+                sdsnew("-ERR resulting score is Not A Number (nan)\r\n"));
+            zfree(score);
+            /* Note that we don't need to check if the zset may be empty and
+             * should be removed here, as we can only obtain Nan as score if
+             * there was already an element in the sorted set. */
+            return;
+        }
     } else {
         *score = scoreval;
     }

tests/unit/type/zset.tcl

@@ -397,4 +397,23 @@ start_server default.conf {} {
         }
         set _ $err
     } {}
+
+    test {ZSET element can't be set to nan with ZADD} {
+        set e {}
+        catch {r zadd myzset nan abc} e
+        set _ $e
+    } {*Not A Number*}
+
+    test {ZSET element can't be set to nan with ZINCRBY} {
+        set e {}
+        catch {r zincrby myzset nan abc} e
+        set _ $e
+    } {*Not A Number*}
+
+    test {ZINCRBY calls leading to Nan are refused} {
+        set e {}
+        r zincrby myzset +inf abc
+        catch {r zincrby myzset -inf abc} e
+        set _ $e
+    } {*Not A Number*}
 }