RESTORE accepts a sorted set with duplicate members (listpack encoding)
Author: vyavdoshenkoCreated Sep 9, 2026Updated Sep 9, 2026
Labelsbug
Found while running the Valkey TCL suite (integration/corrupt-dump) against Dragonfly. A RESTORE payload for a listpack-encoded sorted set that contains the same member twice is accepted and stored verbatim, so ZCARD reports two members with the same name. The object re-serializes through DUMP unchanged, so the corruption propagates to replicas and RDB files. (This is the sorted-set sibling of the duplicate-field hash already fixed for RESTORE.)
Reproduce with a small Python client (the payload is binary):
import socket
# ZSET listpack with member "a" twice (scores 1 and 2), version 9, valid CRC64
val = bytes([0x11,0x11,0x11,0x00,0x00,0x00,0x04,0x00,0x81,0x61,0x02,0x01,0x01,
0x81,0x61,0x02,0x02,0x01,0xff,0x09,0x00,0x7c,0xc5,0xa4,0xcd,0xd6,0xb2,0x17,0x43])
s = socket.create_connection(("localhost", 6379))
s.sendall(b"*4\r\n$7\r\nRESTORE\r\n$2\r\nzd\r\n$1\r\n0\r\n$" + str(len(val)).encode() + b"\r\n" + val + b"\r\n")
print(s.recv(80)) # +OK (should be an error)
# redis-cli zcard zd -> 2
# redis-cli zrange zd 0 -1 withscores -> a 1 a 2Source: dragonflydb/dragonfly