fix(vector): a truncated FT.CREATE no longer aborts the whole process (#681) - #682

Closes #681.

The bug

$ redis-cli FT.CREATE tidx ON HASH PREFIX 1 d: SCHEMA v VECTOR HNSW
Error: Server closed the connection
$ redis-cli PING
Could not connect to Redis: Connection refused

thread 'shard-0' panicked at src/command/vector_search/ft_create.rs:550:39:
index out of bounds: the len is 10 but the index is 10
FATAL: thread 'shard-0' panicked; aborting the whole process rather than
serving with a dead shard or a dead cluster control plane

parse_vector_field_params bounds-checks the algorithm keyword, advances past
it, then reads the parameter count with no second check. When HNSW is the
last argument, *pos becomes args.len(). The panic is on a shard thread and
moon escalates that to a process abort by design, so the blast radius is the
whole server — every database, every other connection. No auth, no large
payload, one short line.

Present on main since the file was written (#27).

Scope was measured, not assumed

My first read was that every *pos += 1; args[*pos] pair in the function was
its own crash — about a dozen. That was wrong. The parameter loop guards both
ends (*pos + 1 < param_end && *pos + 1 < args.len()), so every value read
is safe; only the count read was unguarded.

Six truncation shapes, each against a freshly spawned server whose listener PID
was checked against the process I started:

A second test pins those seven neighbours as already-bounded, so a future edit
to the loop condition cannot quietly reopen the hole one keyword further in.

The fix

One bounds check returning ERR invalid param count — the error an
unparseable count already produced, so the two ways of failing to supply a
count are indistinguishable to a client. There is no redis oracle for the
string: the redis-server checked against has no query engine, so FT.CREATE
is unknown command there.

The fuzz target took three designs

FT.CREATE argument parsing had no fuzz target for its whole life, which
is how a one-line remote crash survived in it. Each design was rejected by
measurement against a deliberately un-fixed parser, not by inspection:

1. Fully-arbitrary argv — 1.2M execs, found nothing. ft_create demands
   the preamble idx ON HASH PREFIX 1 d: SCHEMA v VECTOR before the vector
   parser is reached, and random mutation does not synthesize a nine-keyword
   sequence. It was fuzzing the preamble and never getting past it: builds,
   runs, reports clean, cannot see the bug it exists for.
2. Skeleton + byte-level tail — 871K execs, still nothing. Reaching the
   parser is not enough; the crash needs the literal ASCII HNSW in argv, and
   inventing a specific four-byte string by mutation is a 2^32 search.
3. Skeleton + one input byte selecting one argv element from the vocabulary
   the parser branches on — finds the panic and writes a reproducer.

Verified in both directions:

• against the un-fixed parser it crashes at ft_create.rs:561 with
  index out of bounds: the len is 10 but the index is 10 and saves an
  artifact;
• that same artifact executes clean against the fix (Executed ... in 46 ms).

Listed in both matrices in fuzz.yml — a target that exists but is not
listed never runs (#576) — and confirmed not caught by the bare-fuzz
gitignore trap.

Verification

• 4/4 new unit tests. The first was proven red for the right reason: it
  failed with the panic itself, not an assertion mismatch.
• End-to-end on a live server, listener PID checked: the crashing command
  answers ERR invalid param count, the server stays up, zero panics in the
  log, FLAT keeps its own distinct message, and a well-formed FT.CREATE
  still returns OK with an index queryable via FT.INFO.
• cargo fmt --check, clippy --all-targets -D warnings on both the
  default and runtime-tokio feature sets.

Summary by CodeRabbit

• Bug Fixes

  • Fixed a server crash when FT.CREATE commands contain truncated or incomplete vector-search arguments.
  • Invalid parameter counts now return a clear ERR invalid param count error.
  • Improved handling of malformed and incomplete vector index configurations.

• Tests

  • Added expanded validation coverage for truncated, invalid, and boundary-case FT.CREATE arguments.
  • Added fuzz testing to improve parser robustness.