String blob bug (#880) (#881)

* fixed segmentation fault bug
in _RAI_TensorParseStringsBlob

* added test for future similar errors
(too many elements in BLOB)

Author: GuyAv46

src/redis_ai_objects/tensor.c

@@ -147,7 +147,12 @@ static int _RAI_TensorParseStringsBlob(const char *tensor_blob, size_t blob_len,
     // if we encounter null-character, we set the next element offset to the next position
     for (size_t i = 0; i < blob_len - 1; i++) {
         if (tensor_blob[i] == '\0') {
-            offsets[elements_counter++] = i + 1;
+            if (elements_counter < tensor_len) {
+                offsets[elements_counter++] = i + 1;
+            } else {
+                elements_counter++;
+                break; // No need to continue if tensor_blob contains more elements than expected
+            }
         }
     }
     if (tensor_blob[blob_len - 1] != '\0' || elements_counter != tensor_len) {

tests/flow/tests_common.py

@@ -115,6 +115,10 @@ def test_common_tensorset_error_replies(env):
     check_error_message(env, con, "Number of string elements in data blob does not match tensor length",
                         'AI.TENSORSET', 'z{0}', 'STRING', 2, 'BLOB', 'single c-string\0')
 
+    # ERR in string tensor blob - number of strings is not compatible with tensor meta data
+    check_error_message(env, con, "Number of string elements in data blob does not match tensor length",
+                        'AI.TENSORSET', 'z{0}', 'STRING', 2, 'BLOB', 'one\0two\0three\0')
+
     # ERR in string tensor blob - number of strings is not compatible with tensor meta data
     check_error_message(env, con, "Number of string elements in data blob does not match tensor length",
                         'AI.TENSORSET', 'z{0}', 'STRING', 2, 'BLOB', 'C-string\0followed by a non C-string')