Fixed bug in AOF rewrite not working because of integer overflow

[redis.git] / src / networking.c

diff --git a/src/networking.c b/src/networking.c
index 634e2107c0fcedb288977daf562f53bb893b8c75..4a6a8afd8c3cc6cd1c4abc7d58c88dd0abb1773c 100644 (file)
--- a/src/networking.c
+++ b/src/networking.c
@@ -16,7 +16,6 @@ redisClient *createClient(int fd) {
 
     anetNonBlock(NULL,fd);
     anetTcpNoDelay(NULL,fd);
 
     anetNonBlock(NULL,fd);
     anetTcpNoDelay(NULL,fd);

-    if (!c) return NULL;

     if (aeCreateFileEvent(server.el,fd,AE_READABLE,
         readQueryFromClient, c) == AE_ERR)
     {
     if (aeCreateFileEvent(server.el,fd,AE_READABLE,
         readQueryFromClient, c) == AE_ERR)
     {


@@ -41,8 +40,10 @@ redisClient *createClient(int fd) {
     c->reply = listCreate();
     listSetFreeMethod(c->reply,decrRefCount);
     listSetDupMethod(c->reply,dupClientReplyValue);
     c->reply = listCreate();
     listSetFreeMethod(c->reply,decrRefCount);
     listSetDupMethod(c->reply,dupClientReplyValue);

-    c->blocking_keys = NULL;
-    c->blocking_keys_num = 0;
+    c->bpop.keys = NULL;
+    c->bpop.count = 0;
+    c->bpop.timeout = 0;
+    c->bpop.target = NULL;

     c->io_keys = listCreate();
     c->watched_keys = listCreate();
     listSetFreeMethod(c->io_keys,decrRefCount);
     c->io_keys = listCreate();
     c->watched_keys = listCreate();
     listSetFreeMethod(c->io_keys,decrRefCount);


@@ -58,9 +59,6 @@ redisClient *createClient(int fd) {
 /* Set the event loop to listen for write events on the client's socket.
  * Typically gets called every time a reply is built. */
 int _installWriteEvent(redisClient *c) {
 /* Set the event loop to listen for write events on the client's socket.
  * Typically gets called every time a reply is built. */
 int _installWriteEvent(redisClient *c) {

-    /* When CLOSE_AFTER_REPLY is set, no more replies may be added! */
-    redisAssert(!(c->flags & REDIS_CLOSE_AFTER_REPLY));
-

     if (c->fd <= 0) return REDIS_ERR;
     if (c->bufpos == 0 && listLength(c->reply) == 0 &&
         (c->replstate == REDIS_REPL_NONE ||
     if (c->fd <= 0) return REDIS_ERR;
     if (c->bufpos == 0 && listLength(c->reply) == 0 &&
         (c->replstate == REDIS_REPL_NONE ||


@@ -86,9 +84,15 @@ robj *dupLastObjectIfNeeded(list *reply) {
     return listNodeValue(ln);
 }
 
     return listNodeValue(ln);
 }
 

+/* -----------------------------------------------------------------------------
+ * Low level functions to add more data to output buffers.
+ * -------------------------------------------------------------------------- */
+

 int _addReplyToBuffer(redisClient *c, char *s, size_t len) {
     size_t available = sizeof(c->buf)-c->bufpos;
 
 int _addReplyToBuffer(redisClient *c, char *s, size_t len) {
     size_t available = sizeof(c->buf)-c->bufpos;
 

+    if (c->flags & REDIS_CLOSE_AFTER_REPLY) return REDIS_OK;
+

     /* If there already are entries in the reply list, we cannot
      * add anything more to the static buffer. */
     if (listLength(c->reply) > 0) return REDIS_ERR;
     /* If there already are entries in the reply list, we cannot
      * add anything more to the static buffer. */
     if (listLength(c->reply) > 0) return REDIS_ERR;


@@ -103,6 +107,9 @@ int _addReplyToBuffer(redisClient *c, char *s, size_t len) {
 
 void _addReplyObjectToList(redisClient *c, robj *o) {
     robj *tail;
 
 void _addReplyObjectToList(redisClient *c, robj *o) {
     robj *tail;

+
+    if (c->flags & REDIS_CLOSE_AFTER_REPLY) return;
+

     if (listLength(c->reply) == 0) {
         incrRefCount(o);
         listAddNodeTail(c->reply,o);
     if (listLength(c->reply) == 0) {
         incrRefCount(o);
         listAddNodeTail(c->reply,o);


@@ -126,6 +133,12 @@ void _addReplyObjectToList(redisClient *c, robj *o) {
  * needed it will be free'd, otherwise it ends up in a robj. */
 void _addReplySdsToList(redisClient *c, sds s) {
     robj *tail;
  * needed it will be free'd, otherwise it ends up in a robj. */
 void _addReplySdsToList(redisClient *c, sds s) {
     robj *tail;

+
+    if (c->flags & REDIS_CLOSE_AFTER_REPLY) {
+        sdsfree(s);
+        return;
+    }
+

     if (listLength(c->reply) == 0) {
         listAddNodeTail(c->reply,createObject(REDIS_STRING,s));
     } else {
     if (listLength(c->reply) == 0) {
         listAddNodeTail(c->reply,createObject(REDIS_STRING,s));
     } else {


@@ -146,6 +159,9 @@ void _addReplySdsToList(redisClient *c, sds s) {
 
 void _addReplyStringToList(redisClient *c, char *s, size_t len) {
     robj *tail;
 
 void _addReplyStringToList(redisClient *c, char *s, size_t len) {
     robj *tail;

+
+    if (c->flags & REDIS_CLOSE_AFTER_REPLY) return;
+

     if (listLength(c->reply) == 0) {
         listAddNodeTail(c->reply,createStringObject(s,len));
     } else {
     if (listLength(c->reply) == 0) {
         listAddNodeTail(c->reply,createStringObject(s,len));
     } else {


@@ -163,9 +179,13 @@ void _addReplyStringToList(redisClient *c, char *s, size_t len) {
     }
 }
 
     }
 }
 

+/* -----------------------------------------------------------------------------
+ * Higher level functions to queue data on the client output buffer.
+ * The following functions are the ones that commands implementations will call.
+ * -------------------------------------------------------------------------- */
+

 void addReply(redisClient *c, robj *obj) {
     if (_installWriteEvent(c) != REDIS_OK) return;
 void addReply(redisClient *c, robj *obj) {
     if (_installWriteEvent(c) != REDIS_OK) return;

-    redisAssert(!server.vm_enabled || obj->storage == REDIS_VM_MEMORY);

 
     /* This is an important place where we can avoid copy-on-write
      * when there is a saving child running, avoiding touching the
 
     /* This is an important place where we can avoid copy-on-write
      * when there is a saving child running, avoiding touching the


@@ -178,6 +198,9 @@ void addReply(redisClient *c, robj *obj) {
         if (_addReplyToBuffer(c,obj->ptr,sdslen(obj->ptr)) != REDIS_OK)
             _addReplyObjectToList(c,obj);
     } else {
         if (_addReplyToBuffer(c,obj->ptr,sdslen(obj->ptr)) != REDIS_OK)
             _addReplyObjectToList(c,obj);
     } else {

+        /* FIXME: convert the long into string and use _addReplyToBuffer()
+         * instead of calling getDecodedObject. As this place in the
+         * code is too performance critical. */

         obj = getDecodedObject(obj);
         if (_addReplyToBuffer(c,obj->ptr,sdslen(obj->ptr)) != REDIS_OK)
             _addReplyObjectToList(c,obj);
         obj = getDecodedObject(obj);
         if (_addReplyToBuffer(c,obj->ptr,sdslen(obj->ptr)) != REDIS_OK)
             _addReplyObjectToList(c,obj);


@@ -275,6 +298,7 @@ void setDeferredMultiBulkLength(redisClient *c, void *node, long length) {
     }
 }
 
     }
 }
 

+/* Add a duble as a bulk reply */

 void addReplyDouble(redisClient *c, double d) {
     char dbuf[128], sbuf[128];
     int dlen, slen;
 void addReplyDouble(redisClient *c, double d) {
     char dbuf[128], sbuf[128];
     int dlen, slen;


@@ -283,6 +307,8 @@ void addReplyDouble(redisClient *c, double d) {
     addReplyString(c,sbuf,slen);
 }
 
     addReplyString(c,sbuf,slen);
 }
 

+/* Add a long long as integer reply or bulk len / multi bulk count.
+ * Basically this is used to output <prefix><long long><crlf>. */

 void _addReplyLongLong(redisClient *c, long long ll, char prefix) {
     char buf[128];
     int len;
 void _addReplyLongLong(redisClient *c, long long ll, char prefix) {
     char buf[128];
     int len;


@@ -294,13 +320,19 @@ void _addReplyLongLong(redisClient *c, long long ll, char prefix) {
 }
 
 void addReplyLongLong(redisClient *c, long long ll) {
 }
 
 void addReplyLongLong(redisClient *c, long long ll) {

-    _addReplyLongLong(c,ll,':');
+    if (ll == 0)
+        addReply(c,shared.czero);
+    else if (ll == 1)
+        addReply(c,shared.cone);
+    else
+        _addReplyLongLong(c,ll,':');

 }
 
 void addReplyMultiBulkLen(redisClient *c, long length) {
     _addReplyLongLong(c,length,'*');
 }
 
 }
 
 void addReplyMultiBulkLen(redisClient *c, long length) {
     _addReplyLongLong(c,length,'*');
 }
 

+/* Create the length prefix of a bulk reply, example: $2234 */

 void addReplyBulkLen(redisClient *c, robj *obj) {
     size_t len;
 
 void addReplyBulkLen(redisClient *c, robj *obj) {
     size_t len;
 


@@ -322,23 +354,38 @@ void addReplyBulkLen(redisClient *c, robj *obj) {
     _addReplyLongLong(c,len,'$');
 }
 
     _addReplyLongLong(c,len,'$');
 }
 

+/* Add a Redis Object as a bulk reply */

 void addReplyBulk(redisClient *c, robj *obj) {
     addReplyBulkLen(c,obj);
     addReply(c,obj);
     addReply(c,shared.crlf);
 }
 
 void addReplyBulk(redisClient *c, robj *obj) {
     addReplyBulkLen(c,obj);
     addReply(c,obj);
     addReply(c,shared.crlf);
 }
 

-/* In the CONFIG command we need to add vanilla C string as bulk replies */
+/* Add a C buffer as bulk reply */
+void addReplyBulkCBuffer(redisClient *c, void *p, size_t len) {
+    _addReplyLongLong(c,len,'$');
+    addReplyString(c,p,len);
+    addReply(c,shared.crlf);
+}
+
+/* Add a C nul term string as bulk reply */

 void addReplyBulkCString(redisClient *c, char *s) {
     if (s == NULL) {
         addReply(c,shared.nullbulk);
     } else {
 void addReplyBulkCString(redisClient *c, char *s) {
     if (s == NULL) {
         addReply(c,shared.nullbulk);
     } else {

-        robj *o = createStringObject(s,strlen(s));
-        addReplyBulk(c,o);
-        decrRefCount(o);
+        addReplyBulkCBuffer(c,s,strlen(s));

     }
 }
 
     }
 }
 

+/* Add a long long as a bulk reply */
+void addReplyBulkLongLong(redisClient *c, long long ll) {
+    char buf[64];
+    int len;
+
+    len = ll2string(buf,64,ll);
+    addReplyBulkCBuffer(c,buf,len);
+}
+

 static void acceptCommonHandler(int fd) {
     redisClient *c;
     if ((c = createClient(fd)) == NULL) {
 static void acceptCommonHandler(int fd) {
     redisClient *c;
     if ((c = createClient(fd)) == NULL) {


@@ -372,7 +419,7 @@ void acceptTcpHandler(aeEventLoop *el, int fd, void *privdata, int mask) {
 
     cfd = anetTcpAccept(server.neterr, fd, cip, &cport);
     if (cfd == AE_ERR) {
 
     cfd = anetTcpAccept(server.neterr, fd, cip, &cport);
     if (cfd == AE_ERR) {

-        redisLog(REDIS_VERBOSE,"Accepting client connection: %s", server.neterr);
+        redisLog(REDIS_WARNING,"Accepting client connection: %s", server.neterr);

         return;
     }
     redisLog(REDIS_VERBOSE,"Accepted %s:%d", cip, cport);
         return;
     }
     redisLog(REDIS_VERBOSE,"Accepted %s:%d", cip, cport);


@@ -387,7 +434,7 @@ void acceptUnixHandler(aeEventLoop *el, int fd, void *privdata, int mask) {
 
     cfd = anetUnixAccept(server.neterr, fd);
     if (cfd == AE_ERR) {
 
     cfd = anetUnixAccept(server.neterr, fd);
     if (cfd == AE_ERR) {

-        redisLog(REDIS_VERBOSE,"Accepting client connection: %s", server.neterr);
+        redisLog(REDIS_WARNING,"Accepting client connection: %s", server.neterr);

         return;
     }
     redisLog(REDIS_VERBOSE,"Accepted connection to %s", server.unixsocket);
         return;
     }
     redisLog(REDIS_VERBOSE,"Accepted connection to %s", server.unixsocket);


@@ -433,10 +480,17 @@ void freeClient(redisClient *c) {
     ln = listSearchKey(server.clients,c);
     redisAssert(ln != NULL);
     listDelNode(server.clients,ln);
     ln = listSearchKey(server.clients,c);
     redisAssert(ln != NULL);
     listDelNode(server.clients,ln);

+    /* When client was just unblocked because of a blocking operation,
+     * remove it from the list with unblocked clients. */
+    if (c->flags & REDIS_UNBLOCKED) {
+        ln = listSearchKey(server.unblocked_clients,c);
+        redisAssert(ln != NULL);
+        listDelNode(server.unblocked_clients,ln);
+    }

     /* Remove from the list of clients waiting for swapped keys, or ready
      * to be restarted, but not yet woken up again. */
     if (c->flags & REDIS_IO_WAIT) {
     /* Remove from the list of clients waiting for swapped keys, or ready
      * to be restarted, but not yet woken up again. */
     if (c->flags & REDIS_IO_WAIT) {

-        redisAssert(server.vm_enabled);
+        redisAssert(server.ds_enabled);

         if (listLength(c->io_keys) == 0) {
             ln = listSearchKey(server.io_ready_clients,c);
 
         if (listLength(c->io_keys) == 0) {
             ln = listSearchKey(server.io_ready_clients,c);
 


@@ -450,7 +504,7 @@ void freeClient(redisClient *c) {
                 dontWaitForSwappedKey(c,ln->value);
             }
         }
                 dontWaitForSwappedKey(c,ln->value);
             }
         }

-        server.vm_blocked_clients--;
+        server.cache_blocked_clients--;

     }
     listRelease(c->io_keys);
     /* Master/slave cleanup.
     }
     listRelease(c->io_keys);
     /* Master/slave cleanup.


@@ -467,16 +521,21 @@ void freeClient(redisClient *c) {
     /* Case 2: we lost the connection with the master. */
     if (c->flags & REDIS_MASTER) {
         server.master = NULL;
     /* Case 2: we lost the connection with the master. */
     if (c->flags & REDIS_MASTER) {
         server.master = NULL;

-        /* FIXME */

         server.replstate = REDIS_REPL_CONNECT;
         /* Since we lost the connection with the master, we should also
          * close the connection with all our slaves if we have any, so
          * when we'll resync with the master the other slaves will sync again
          * with us as well. Note that also when the slave is not connected
         server.replstate = REDIS_REPL_CONNECT;
         /* Since we lost the connection with the master, we should also
          * close the connection with all our slaves if we have any, so
          * when we'll resync with the master the other slaves will sync again
          * with us as well. Note that also when the slave is not connected

-         * to the master it will keep refusing connections by other slaves. */
-        while (listLength(server.slaves)) {
-            ln = listFirst(server.slaves);
-            freeClient((redisClient*)ln->value);
+         * to the master it will keep refusing connections by other slaves.
+         *
+         * We do this only if server.masterhost != NULL. If it is NULL this
+         * means the user called SLAVEOF NO ONE and we are freeing our
+         * link with the master, so no need to close link with slaves. */
+        if (server.masterhost != NULL) {
+            while (listLength(server.slaves)) {
+                ln = listFirst(server.slaves);
+                freeClient((redisClient*)ln->value);
+            }

         }
     }
     /* Release memory */
         }
     }
     /* Release memory */


@@ -492,15 +551,6 @@ void sendReplyToClient(aeEventLoop *el, int fd, void *privdata, int mask) {
     REDIS_NOTUSED(el);
     REDIS_NOTUSED(mask);
 
     REDIS_NOTUSED(el);
     REDIS_NOTUSED(mask);
 

-    /* Use writev() if we have enough buffers to send */
-    if (!server.glueoutputbuf &&
-        listLength(c->reply) > REDIS_WRITEV_THRESHOLD &&
-        !(c->flags & REDIS_MASTER))
-    {
-        sendReplyToClientWritev(el, fd, privdata, mask);
-        return;
-    }
-

     while(c->bufpos > 0 || listLength(c->reply)) {
         if (c->bufpos > 0) {
             if (c->flags & REDIS_MASTER) {
     while(c->bufpos > 0 || listLength(c->reply)) {
         if (c->bufpos > 0) {
             if (c->flags & REDIS_MASTER) {


@@ -571,84 +621,6 @@ void sendReplyToClient(aeEventLoop *el, int fd, void *privdata, int mask) {
     }
 }
 
     }
 }
 

-void sendReplyToClientWritev(aeEventLoop *el, int fd, void *privdata, int mask)
-{
-    redisClient *c = privdata;
-    int nwritten = 0, totwritten = 0, objlen, willwrite;
-    robj *o;
-    struct iovec iov[REDIS_WRITEV_IOVEC_COUNT];
-    int offset, ion = 0;
-    REDIS_NOTUSED(el);
-    REDIS_NOTUSED(mask);
-
-    listNode *node;
-    while (listLength(c->reply)) {
-        offset = c->sentlen;
-        ion = 0;
-        willwrite = 0;
-
-        /* fill-in the iov[] array */
-        for(node = listFirst(c->reply); node; node = listNextNode(node)) {
-            o = listNodeValue(node);
-            objlen = sdslen(o->ptr);
-
-            if (totwritten + objlen - offset > REDIS_MAX_WRITE_PER_EVENT)
-                break;
-
-            if(ion == REDIS_WRITEV_IOVEC_COUNT)
-                break; /* no more iovecs */
-
-            iov[ion].iov_base = ((char*)o->ptr) + offset;
-            iov[ion].iov_len = objlen - offset;
-            willwrite += objlen - offset;
-            offset = 0; /* just for the first item */
-            ion++;
-        }
-
-        if(willwrite == 0)
-            break;
-
-        /* write all collected blocks at once */
-        if((nwritten = writev(fd, iov, ion)) < 0) {
-            if (errno != EAGAIN) {
-                redisLog(REDIS_VERBOSE,
-                         "Error writing to client: %s", strerror(errno));
-                freeClient(c);
-                return;
-            }
-            break;
-        }
-
-        totwritten += nwritten;
-        offset = c->sentlen;
-
-        /* remove written robjs from c->reply */
-        while (nwritten && listLength(c->reply)) {
-            o = listNodeValue(listFirst(c->reply));
-            objlen = sdslen(o->ptr);
-
-            if(nwritten >= objlen - offset) {
-                listDelNode(c->reply, listFirst(c->reply));
-                nwritten -= objlen - offset;
-                c->sentlen = 0;
-            } else {
-                /* partial write */
-                c->sentlen += nwritten;
-                break;
-            }
-            offset = 0;
-        }
-    }
-
-    if (totwritten > 0)
-        c->lastinteraction = time(NULL);
-
-    if (listLength(c->reply) == 0) {
-        c->sentlen = 0;
-        aeDeleteFileEvent(server.el,c->fd,AE_WRITABLE);
-    }
-}
-

 /* resetClient prepare the client to process the next command */
 void resetClient(redisClient *c) {
     freeClientArgv(c);
 /* resetClient prepare the client to process the next command */
 void resetClient(redisClient *c) {
     freeClientArgv(c);


@@ -677,7 +649,7 @@ void closeTimedoutClients(void) {
             redisLog(REDIS_VERBOSE,"Closing idle client");
             freeClient(c);
         } else if (c->flags & REDIS_BLOCKED) {
             redisLog(REDIS_VERBOSE,"Closing idle client");
             freeClient(c);
         } else if (c->flags & REDIS_BLOCKED) {

-            if (c->blockingto != 0 && c->blockingto < now) {
+            if (c->bpop.timeout != 0 && c->bpop.timeout < now) {

                 addReply(c,shared.nullmultibulk);
                 unblockClientWaitingData(c);
             }
                 addReply(c,shared.nullmultibulk);
                 unblockClientWaitingData(c);
             }


@@ -728,70 +700,74 @@ static void setProtocolError(redisClient *c, int pos) {
 
 int processMultibulkBuffer(redisClient *c) {
     char *newline = NULL;
 
 int processMultibulkBuffer(redisClient *c) {
     char *newline = NULL;

-    char *eptr;
-    int pos = 0, tolerr;
-    long bulklen;
+    int pos = 0, ok;
+    long long ll;

 
     if (c->multibulklen == 0) {
         /* The client should have been reset */
         redisAssert(c->argc == 0);
 
         /* Multi bulk length cannot be read without a \r\n */
 
     if (c->multibulklen == 0) {
         /* The client should have been reset */
         redisAssert(c->argc == 0);
 
         /* Multi bulk length cannot be read without a \r\n */

-        newline = strstr(c->querybuf,"\r\n");
+        newline = strchr(c->querybuf,'\r');

         if (newline == NULL)
             return REDIS_ERR;
 
         if (newline == NULL)
             return REDIS_ERR;
 

+        /* Buffer should also contain \n */
+        if (newline-(c->querybuf) > ((signed)sdslen(c->querybuf)-2))
+            return REDIS_ERR;
+

         /* We know for sure there is a whole line since newline != NULL,
          * so go ahead and find out the multi bulk length. */
         redisAssert(c->querybuf[0] == '*');
         /* We know for sure there is a whole line since newline != NULL,
          * so go ahead and find out the multi bulk length. */
         redisAssert(c->querybuf[0] == '*');

-        c->multibulklen = strtol(c->querybuf+1,&eptr,10);
-        pos = (newline-c->querybuf)+2;
-        if (c->multibulklen <= 0) {
-            c->querybuf = sdsrange(c->querybuf,pos,-1);
-            return REDIS_OK;
-        } else if (c->multibulklen > 1024*1024) {
+        ok = string2ll(c->querybuf+1,newline-(c->querybuf+1),&ll);
+        if (!ok || ll > 1024*1024) {

             addReplyError(c,"Protocol error: invalid multibulk length");
             setProtocolError(c,pos);
             return REDIS_ERR;
         }
 
             addReplyError(c,"Protocol error: invalid multibulk length");
             setProtocolError(c,pos);
             return REDIS_ERR;
         }
 

+        pos = (newline-c->querybuf)+2;
+        if (ll <= 0) {
+            c->querybuf = sdsrange(c->querybuf,pos,-1);
+            return REDIS_OK;
+        }
+
+        c->multibulklen = ll;
+

         /* Setup argv array on client structure */
         if (c->argv) zfree(c->argv);
         c->argv = zmalloc(sizeof(robj*)*c->multibulklen);
         /* Setup argv array on client structure */
         if (c->argv) zfree(c->argv);
         c->argv = zmalloc(sizeof(robj*)*c->multibulklen);

-
-        /* Search new newline */
-        newline = strstr(c->querybuf+pos,"\r\n");

     }
 
     redisAssert(c->multibulklen > 0);
     while(c->multibulklen) {
         /* Read bulk length if unknown */
         if (c->bulklen == -1) {
     }
 
     redisAssert(c->multibulklen > 0);
     while(c->multibulklen) {
         /* Read bulk length if unknown */
         if (c->bulklen == -1) {

-            newline = strstr(c->querybuf+pos,"\r\n");
-            if (newline != NULL) {
-                if (c->querybuf[pos] != '$') {
-                    addReplyErrorFormat(c,
-                        "Protocol error: expected '$', got '%c'",
-                        c->querybuf[pos]);
-                    setProtocolError(c,pos);
-                    return REDIS_ERR;
-                }
+            newline = strchr(c->querybuf+pos,'\r');
+            if (newline == NULL)
+                break;

 
 

-                bulklen = strtol(c->querybuf+pos+1,&eptr,10);
-                tolerr = (eptr[0] != '\r');
-                if (tolerr || bulklen == LONG_MIN || bulklen == LONG_MAX ||
-                    bulklen < 0 || bulklen > 1024*1024*1024)
-                {
-                    addReplyError(c,"Protocol error: invalid bulk length");
-                    setProtocolError(c,pos);
-                    return REDIS_ERR;
-                }
-                pos += eptr-(c->querybuf+pos)+2;
-                c->bulklen = bulklen;
-            } else {
-                /* No newline in current buffer, so wait for more data */
+            /* Buffer should also contain \n */
+            if (newline-(c->querybuf) > ((signed)sdslen(c->querybuf)-2))

                 break;
                 break;

+
+            if (c->querybuf[pos] != '$') {
+                addReplyErrorFormat(c,
+                    "Protocol error: expected '$', got '%c'",
+                    c->querybuf[pos]);
+                setProtocolError(c,pos);
+                return REDIS_ERR;
+            }
+
+            ok = string2ll(c->querybuf+pos+1,newline-(c->querybuf+pos+1),&ll);
+            if (!ok || ll < 0 || ll > 512*1024*1024) {
+                addReplyError(c,"Protocol error: invalid bulk length");
+                setProtocolError(c,pos);
+                return REDIS_ERR;

             }
             }

+
+            pos += newline-(c->querybuf+pos)+2;
+            c->bulklen = ll;

         }
 
         /* Read bulk argument */
         }
 
         /* Read bulk argument */


@@ -884,3 +860,89 @@ void readQueryFromClient(aeEventLoop *el, int fd, void *privdata, int mask) {
     }
     processInputBuffer(c);
 }
     }
     processInputBuffer(c);
 }

+
+void getClientsMaxBuffers(unsigned long *longest_output_list,
+                          unsigned long *biggest_input_buffer) {
+    redisClient *c;
+    listNode *ln;
+    listIter li;
+    unsigned long lol = 0, bib = 0;
+
+    listRewind(server.clients,&li);
+    while ((ln = listNext(&li)) != NULL) {
+        c = listNodeValue(ln);
+
+        if (listLength(c->reply) > lol) lol = listLength(c->reply);
+        if (sdslen(c->querybuf) > bib) bib = sdslen(c->querybuf);
+    }
+    *longest_output_list = lol;
+    *biggest_input_buffer = bib;
+}
+
+void clientCommand(redisClient *c) {
+    listNode *ln;
+    listIter li;
+    redisClient *client;
+
+    if (!strcasecmp(c->argv[1]->ptr,"list") && c->argc == 2) {
+        sds o = sdsempty();
+        time_t now = time(NULL);
+
+        listRewind(server.clients,&li);
+        while ((ln = listNext(&li)) != NULL) {
+            char ip[32], flags[16], *p;
+            int port;
+
+            client = listNodeValue(ln);
+            if (anetPeerToString(client->fd,ip,&port) == -1) continue;
+            p = flags;
+            if (client->flags & REDIS_SLAVE) {
+                if (client->flags & REDIS_MONITOR)
+                    *p++ = 'O';
+                else
+                    *p++ = 'S';
+            }
+            if (client->flags & REDIS_MASTER) *p++ = 'M';
+            if (p == flags) *p++ = 'N';
+            if (client->flags & REDIS_MULTI) *p++ = 'x';
+            if (client->flags & REDIS_BLOCKED) *p++ = 'b';
+            if (client->flags & REDIS_IO_WAIT) *p++ = 'i';
+            if (client->flags & REDIS_DIRTY_CAS) *p++ = 'd';
+            if (client->flags & REDIS_CLOSE_AFTER_REPLY) *p++ = 'c';
+            if (client->flags & REDIS_UNBLOCKED) *p++ = 'u';
+            *p++ = '\0';
+            o = sdscatprintf(o,
+                "addr=%s:%d fd=%d idle=%ld flags=%s db=%d sub=%d psub=%d\n",
+                ip,port,client->fd,
+                (long)(now - client->lastinteraction),
+                flags,
+                client->db->id,
+                (int) dictSize(client->pubsub_channels),
+                (int) listLength(client->pubsub_patterns));
+        }
+        addReplyBulkCBuffer(c,o,sdslen(o));
+        sdsfree(o);
+    } else if (!strcasecmp(c->argv[1]->ptr,"kill") && c->argc == 3) {
+        listRewind(server.clients,&li);
+        while ((ln = listNext(&li)) != NULL) {
+            char ip[32], addr[64];
+            int port;
+
+            client = listNodeValue(ln);
+            if (anetPeerToString(client->fd,ip,&port) == -1) continue;
+            snprintf(addr,sizeof(addr),"%s:%d",ip,port);
+            if (strcmp(addr,c->argv[2]->ptr) == 0) {
+                addReply(c,shared.ok);
+                if (c == client) {
+                    client->flags |= REDIS_CLOSE_AFTER_REPLY;
+                } else {
+                    freeClient(client);
+                }
+                return;
+            }
+        }
+        addReplyError(c,"No such client");
+    } else {
+        addReplyError(c, "Syntax error, try CLIENT (LIST | KILL ip:port)");
+    }
+}