From 23af41ca070386c0fe55b070cca36fb32ed889eb Mon Sep 17 00:00:00 2001
From: Roman Gershman <roman@dragonflydb.io>
Date: Fri, 24 Jan 2025 13:53:09 +0200
Subject: [PATCH] fix: several bugs (#4500)

1. Fixes #4466 (we did not check validity of the scan cursor)
   We fix it by quietly returning "end of scan" result, i.e. no error are returned.
2. Add 34b1048274c8e50a0cc587a3ed9c383a82bb78c5 sha to the lua_undeclared_keys_shas list.
3. Pull helio that fixes bugs with WaitQueue and IdleTasks: https://github.com/romange/helio/commit/2ab4412b78afbf7d3102b472fb0e6f70b194a535
---
 helio                             | 2 +-
 src/core/dash.h                   | 7 ++++---
 src/server/generic_family_test.cc | 5 +++++
 src/server/script_mgr.cc          | 1 +
 4 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/helio b/helio
index 05c316e17..2ab4412b7 160000
--- a/helio
+++ b/helio
@@ -1 +1 @@
-Subproject commit 05c316e171e31a6f23165b426b7caf0174f90838
+Subproject commit 2ab4412b78afbf7d3102b472fb0e6f70b194a535
diff --git a/src/core/dash.h b/src/core/dash.h
index de7a025d4..09dad365b 100644
--- a/src/core/dash.h
+++ b/src/core/dash.h
@@ -954,12 +954,13 @@ auto DashTable<_Key, _Value, Policy>::GetRandomCursor(absl::BitGen* bitgen) -> C
 template <typename _Key, typename _Value, typename Policy>
 template <typename Cb>
 auto DashTable<_Key, _Value, Policy>::Traverse(Cursor curs, Cb&& cb) -> Cursor {
-  if (curs.bucket_id() >= Policy::kBucketNum)  // sanity.
-    return 0;
-
   uint32_t sid = curs.segment_id(global_depth_);
   uint8_t bid = curs.bucket_id();
 
+  // Test validity of the cursor.
+  if (bid >= Policy::kBucketNum || sid >= segment_.size())
+    return 0;
+
   auto hash_fun = [this](const auto& k) { return policy_.HashFn(k); };
 
   bool fetched = false;
diff --git a/src/server/generic_family_test.cc b/src/server/generic_family_test.cc
index 68d54ea6f..e2c1ed605 100644
--- a/src/server/generic_family_test.cc
+++ b/src/server/generic_family_test.cc
@@ -872,4 +872,9 @@ TEST_F(GenericFamilyTest, RestoreOOM) {
   EXPECT_THAT(resp, ErrArg("Out of memory"));
 }
 
+TEST_F(GenericFamilyTest, Bug4466) {
+  auto resp = Run({"SCAN","9223372036854775808"});  // an invalid cursor should not crash us.
+  EXPECT_THAT(resp, RespElementsAre("0", RespElementsAre()));
+}
+
 }  // namespace dfly
diff --git a/src/server/script_mgr.cc b/src/server/script_mgr.cc
index 0053a02f4..ee29617a7 100644
--- a/src/server/script_mgr.cc
+++ b/src/server/script_mgr.cc
@@ -43,6 +43,7 @@ ABSL_FLAG(
     std::vector<std::string>({
         "351130589c64523cb98978dc32c64173a31244f3",  // Sidekiq, see #2442
         "6ae15ef4678593dc61f991c9953722d67d822776",  // Sidekiq, see #2442
+        "34b1048274c8e50a0cc587a3ed9c383a82bb78c5"   // Sidekiq
     }),
     "Comma-separated list of Lua script SHAs which are allowed to access undeclared keys. SHAs are "
     "only looked at when loading the script, and new values do not affect already-loaded script.");