Additional overflow protection for MAP/ATTR

There is already overflow protection for multibulk `elements` but the
new RESP3 `MAP` and `ATTR` types subsequently double the count.

This meant that a malicious or erroneous count of `LLONG_MAX / 2 + 1`
would end up overflowing when maxelements = 0.

Signed-off-by: michael-grunder <michael.grunder@gmail.com>

Author: michael-grunder

src/read.c

@@ -556,8 +556,23 @@ static int processAggregateItem(valkeyReader *r) {
 
             moveToNextTask(r);
         } else {
-            if (cur->type == VALKEY_REPLY_MAP || cur->type == VALKEY_REPLY_ATTR)
+            if (cur->type == VALKEY_REPLY_MAP ||
+                cur->type == VALKEY_REPLY_ATTR) {
+
+                long long maxelements = LLONG_MAX / 2;
+                if (LLONG_MAX > SIZE_MAX &&
+                    maxelements > (long long)(SIZE_MAX / 2)) {
+                    maxelements = (long long)(SIZE_MAX / 2);
+                }
+
+                if (elements > maxelements) {
+                    valkeyReaderSetError(r, VALKEY_ERR_PROTOCOL,
+                                         "Multi-bulk length out of range");
+                    return VALKEY_ERR;
+                }
+
                 elements *= 2;
+            }
 
             if (r->fn && r->fn->createArray)
                 obj = r->fn->createArray(cur, elements);

tests/client_test.c

@@ -872,6 +872,16 @@ static void test_reply_reader(void) {
     freeReplyObject(reply);
     valkeyReaderFree(reader);
 
+    /* RESP3 MAP/ATTR types double the element count being key-value pairs */
+    test("A RESP3 MAP/ATTR can't overflow: ");
+    reader = valkeyReaderCreate();
+    reader->maxelements = 0; /* Don't rely on default limit */
+    valkeyReaderFeed(reader, "%4611686018427387904\r\n", 22);
+    ret = valkeyReaderGetReply(reader, &reply);
+    test_cond(ret == VALKEY_ERR &&
+              strcasecmp(reader->errstr, "Multi-bulk length out of range") == 0);
+    valkeyReaderFree(reader);
+
     test("Can parse RESP3 attribute: ");
     reader = valkeyReaderCreate();
     valkeyReaderFeed(reader, "|2\r\n+foo\r\n:123\r\n+bar\r\n#t\r\n", 26);