A fix for an invalid access when VM is disabled

[redis.git] / redis.c

diff --git a/redis.c b/redis.c
index c10fb03af95b2ad483c395baecbd19c54eba1667..c6283e498d13337c1c986d5bc5b173da3f386e4b 100644 (file)
--- a/redis.c
+++ b/redis.c
@@ -27,7 +27,7 @@
  * POSSIBILITY OF SUCH DAMAGE.
  */
 
  * POSSIBILITY OF SUCH DAMAGE.
  */
 

-#define REDIS_VERSION "1.3.3"
+#define REDIS_VERSION "1.3.4"

 
 #include "fmacros.h"
 #include "config.h"
 
 #include "fmacros.h"
 #include "config.h"


@@ -38,6 +38,7 @@
 #include <time.h>
 #include <unistd.h>
 #define __USE_POSIX199309
 #include <time.h>
 #include <unistd.h>
 #define __USE_POSIX199309

+#define __USE_UNIX98

 #include <signal.h>
 
 #ifdef HAVE_BACKTRACE
 #include <signal.h>
 
 #ifdef HAVE_BACKTRACE


@@ -455,6 +456,7 @@ typedef struct _redisSortOperation {
 typedef struct zskiplistNode {
     struct zskiplistNode **forward;
     struct zskiplistNode *backward;
 typedef struct zskiplistNode {
     struct zskiplistNode **forward;
     struct zskiplistNode *backward;

+    unsigned int *span;

     double score;
     robj *obj;
 } zskiplistNode;
     double score;
     robj *obj;
 } zskiplistNode;


@@ -657,6 +659,8 @@ static void discardCommand(redisClient *c);
 static void blpopCommand(redisClient *c);
 static void brpopCommand(redisClient *c);
 static void appendCommand(redisClient *c);
 static void blpopCommand(redisClient *c);
 static void brpopCommand(redisClient *c);
 static void appendCommand(redisClient *c);

+static void substrCommand(redisClient *c);
+static void zrankCommand(redisClient *c);

 
 /*================================= Globals ================================= */
 
 
 /*================================= Globals ================================= */
 


@@ -667,6 +671,7 @@ static struct redisCommand cmdTable[] = {
     {"set",setCommand,3,REDIS_CMD_BULK|REDIS_CMD_DENYOOM,0,0,0},
     {"setnx",setnxCommand,3,REDIS_CMD_BULK|REDIS_CMD_DENYOOM,0,0,0},
     {"append",appendCommand,3,REDIS_CMD_BULK|REDIS_CMD_DENYOOM,1,1,1},
     {"set",setCommand,3,REDIS_CMD_BULK|REDIS_CMD_DENYOOM,0,0,0},
     {"setnx",setnxCommand,3,REDIS_CMD_BULK|REDIS_CMD_DENYOOM,0,0,0},
     {"append",appendCommand,3,REDIS_CMD_BULK|REDIS_CMD_DENYOOM,1,1,1},

+    {"substr",substrCommand,4,REDIS_CMD_INLINE,1,1,1},

     {"del",delCommand,-2,REDIS_CMD_INLINE,0,0,0},
     {"exists",existsCommand,2,REDIS_CMD_INLINE,1,1,1},
     {"incr",incrCommand,2,REDIS_CMD_INLINE|REDIS_CMD_DENYOOM,1,1,1},
     {"del",delCommand,-2,REDIS_CMD_INLINE,0,0,0},
     {"exists",existsCommand,2,REDIS_CMD_INLINE,1,1,1},
     {"incr",incrCommand,2,REDIS_CMD_INLINE|REDIS_CMD_DENYOOM,1,1,1},


@@ -709,6 +714,7 @@ static struct redisCommand cmdTable[] = {
     {"zrevrange",zrevrangeCommand,-4,REDIS_CMD_INLINE,1,1,1},
     {"zcard",zcardCommand,2,REDIS_CMD_INLINE,1,1,1},
     {"zscore",zscoreCommand,3,REDIS_CMD_BULK|REDIS_CMD_DENYOOM,1,1,1},
     {"zrevrange",zrevrangeCommand,-4,REDIS_CMD_INLINE,1,1,1},
     {"zcard",zcardCommand,2,REDIS_CMD_INLINE,1,1,1},
     {"zscore",zscoreCommand,3,REDIS_CMD_BULK|REDIS_CMD_DENYOOM,1,1,1},

+    {"zrank",zrankCommand,3,REDIS_CMD_INLINE,1,1,1},

     {"incrby",incrbyCommand,3,REDIS_CMD_INLINE|REDIS_CMD_DENYOOM,1,1,1},
     {"decrby",decrbyCommand,3,REDIS_CMD_INLINE|REDIS_CMD_DENYOOM,1,1,1},
     {"getset",getsetCommand,3,REDIS_CMD_BULK|REDIS_CMD_DENYOOM,1,1,1},
     {"incrby",incrbyCommand,3,REDIS_CMD_INLINE|REDIS_CMD_DENYOOM,1,1,1},
     {"decrby",decrbyCommand,3,REDIS_CMD_INLINE|REDIS_CMD_DENYOOM,1,1,1},
     {"getset",getsetCommand,3,REDIS_CMD_BULK|REDIS_CMD_DENYOOM,1,1,1},


@@ -3530,7 +3536,7 @@ static void setGenericCommand(redisClient *c, int nx) {
              * to overwrite the old. So we delete the old key in the database.
              * This will also make sure that swap pages about the old object
              * will be marked as free. */
              * to overwrite the old. So we delete the old key in the database.
              * This will also make sure that swap pages about the old object
              * will be marked as free. */

-            if (deleteIfSwapped(c->db,c->argv[1]))
+            if (server.vm_enabled && deleteIfSwapped(c->db,c->argv[1]))

                 incrRefCount(c->argv[1]);
             dictReplace(c->db->dict,c->argv[1],c->argv[2]);
             incrRefCount(c->argv[2]);
                 incrRefCount(c->argv[1]);
             dictReplace(c->db->dict,c->argv[1],c->argv[2]);
             incrRefCount(c->argv[2]);


@@ -3760,6 +3766,50 @@ static void appendCommand(redisClient *c) {
     addReplySds(c,sdscatprintf(sdsempty(),":%lu\r\n",(unsigned long)totlen));
 }
 
     addReplySds(c,sdscatprintf(sdsempty(),":%lu\r\n",(unsigned long)totlen));
 }
 

+static void substrCommand(redisClient *c) {
+    robj *o;
+    long start = atoi(c->argv[2]->ptr);
+    long end = atoi(c->argv[3]->ptr);
+
+    o = lookupKeyRead(c->db,c->argv[1]);
+    if (o == NULL) {
+        addReply(c,shared.nullbulk);
+    } else {
+        if (o->type != REDIS_STRING) {
+            addReply(c,shared.wrongtypeerr);
+        } else {
+            size_t rangelen, strlen;
+            sds range;
+
+            o = getDecodedObject(o);
+            strlen = sdslen(o->ptr);
+
+            /* convert negative indexes */
+            if (start < 0) start = strlen+start;
+            if (end < 0) end = strlen+end;
+            if (start < 0) start = 0;
+            if (end < 0) end = 0;
+
+            /* indexes sanity checks */
+            if (start > end || (size_t)start >= strlen) {
+                /* Out of range start or start > end result in null reply */
+                addReply(c,shared.nullbulk);
+                decrRefCount(o);
+                return;
+            }
+            if ((size_t)end >= strlen) end = strlen-1;
+            rangelen = (end-start)+1;
+
+            /* Return the result */
+            addReplySds(c,sdscatprintf(sdsempty(),"$%lu\r\n",rangelen));
+            range = sdsnewlen((char*)o->ptr+start,rangelen);
+            addReplySds(c,range);
+            addReply(c,shared.crlf);
+            decrRefCount(o);
+        }
+    }
+}
+

 /* ========================= Type agnostic commands ========================= */
 
 static void delCommand(redisClient *c) {
 /* ========================= Type agnostic commands ========================= */
 
 static void delCommand(redisClient *c) {


@@ -4025,7 +4075,7 @@ static void pushGenericCommand(redisClient *c, int where) {
     lobj = lookupKeyWrite(c->db,c->argv[1]);
     if (lobj == NULL) {
         if (handleClientsWaitingListPush(c,c->argv[1],c->argv[2])) {
     lobj = lookupKeyWrite(c->db,c->argv[1]);
     if (lobj == NULL) {
         if (handleClientsWaitingListPush(c,c->argv[1],c->argv[2])) {

-            addReply(c,shared.ok);
+            addReply(c,shared.cone);

             return;
         }
         lobj = createListObject();
             return;
         }
         lobj = createListObject();


@@ -4044,7 +4094,7 @@ static void pushGenericCommand(redisClient *c, int where) {
             return;
         }
         if (handleClientsWaitingListPush(c,c->argv[1],c->argv[2])) {
             return;
         }
         if (handleClientsWaitingListPush(c,c->argv[1],c->argv[2])) {

-            addReply(c,shared.ok);
+            addReply(c,shared.cone);

             return;
         }
         list = lobj->ptr;
             return;
         }
         list = lobj->ptr;


@@ -4056,7 +4106,7 @@ static void pushGenericCommand(redisClient *c, int where) {
         incrRefCount(c->argv[2]);
     }
     server.dirty++;
         incrRefCount(c->argv[2]);
     }
     server.dirty++;

-    addReply(c,shared.ok);
+    addReplySds(c,sdscatprintf(sdsempty(),":%d\r\n",listLength(list)));

 }
 
 static void lpushCommand(redisClient *c) {
 }
 
 static void lpushCommand(redisClient *c) {


@@ -4794,6 +4844,8 @@ static zskiplistNode *zslCreateNode(int level, double score, robj *obj) {
     zskiplistNode *zn = zmalloc(sizeof(*zn));
 
     zn->forward = zmalloc(sizeof(zskiplistNode*) * level);
     zskiplistNode *zn = zmalloc(sizeof(*zn));
 
     zn->forward = zmalloc(sizeof(zskiplistNode*) * level);

+    if (level > 0)
+        zn->span = zmalloc(sizeof(unsigned int) * (level - 1));

     zn->score = score;
     zn->obj = obj;
     return zn;
     zn->score = score;
     zn->obj = obj;
     return zn;


@@ -4807,8 +4859,10 @@ static zskiplist *zslCreate(void) {
     zsl->level = 1;
     zsl->length = 0;
     zsl->header = zslCreateNode(ZSKIPLIST_MAXLEVEL,0,NULL);
     zsl->level = 1;
     zsl->length = 0;
     zsl->header = zslCreateNode(ZSKIPLIST_MAXLEVEL,0,NULL);

-    for (j = 0; j < ZSKIPLIST_MAXLEVEL; j++)
+    for (j = 0; j < ZSKIPLIST_MAXLEVEL; j++) {

         zsl->header->forward[j] = NULL;
         zsl->header->forward[j] = NULL;

+        zsl->header->span[j] = 0;
+    }

     zsl->header->backward = NULL;
     zsl->tail = NULL;
     return zsl;
     zsl->header->backward = NULL;
     zsl->tail = NULL;
     return zsl;


@@ -4817,6 +4871,7 @@ static zskiplist *zslCreate(void) {
 static void zslFreeNode(zskiplistNode *node) {
     decrRefCount(node->obj);
     zfree(node->forward);
 static void zslFreeNode(zskiplistNode *node) {
     decrRefCount(node->obj);
     zfree(node->forward);

+    zfree(node->span);

     zfree(node);
 }
 
     zfree(node);
 }
 


@@ -4824,6 +4879,7 @@ static void zslFree(zskiplist *zsl) {
     zskiplistNode *node = zsl->header->forward[0], *next;
 
     zfree(zsl->header->forward);
     zskiplistNode *node = zsl->header->forward[0], *next;
 
     zfree(zsl->header->forward);

+    zfree(zsl->header->span);

     zfree(zsl->header);
     while(node) {
         next = node->forward[0];
     zfree(zsl->header);
     while(node) {
         next = node->forward[0];


@@ -4842,15 +4898,21 @@ static int zslRandomLevel(void) {
 
 static void zslInsert(zskiplist *zsl, double score, robj *obj) {
     zskiplistNode *update[ZSKIPLIST_MAXLEVEL], *x;
 
 static void zslInsert(zskiplist *zsl, double score, robj *obj) {
     zskiplistNode *update[ZSKIPLIST_MAXLEVEL], *x;

+    unsigned int rank[ZSKIPLIST_MAXLEVEL];

     int i, level;
 
     x = zsl->header;
     for (i = zsl->level-1; i >= 0; i--) {
     int i, level;
 
     x = zsl->header;
     for (i = zsl->level-1; i >= 0; i--) {

+        /* store rank that is crossed to reach the insert position */
+        rank[i] = i == (zsl->level-1) ? 0 : rank[i+1];
+

         while (x->forward[i] &&
             (x->forward[i]->score < score ||
                 (x->forward[i]->score == score &&
         while (x->forward[i] &&
             (x->forward[i]->score < score ||
                 (x->forward[i]->score == score &&

-                compareStringObjects(x->forward[i]->obj,obj) < 0)))
+                compareStringObjects(x->forward[i]->obj,obj) < 0))) {
+            rank[i] += i > 0 ? x->span[i-1] : 1;

             x = x->forward[i];
             x = x->forward[i];

+        }

         update[i] = x;
     }
     /* we assume the key is not already inside, since we allow duplicated
         update[i] = x;
     }
     /* we assume the key is not already inside, since we allow duplicated


@@ -4859,15 +4921,30 @@ static void zslInsert(zskiplist *zsl, double score, robj *obj) {
      * if the element is already inside or not. */
     level = zslRandomLevel();
     if (level > zsl->level) {
      * if the element is already inside or not. */
     level = zslRandomLevel();
     if (level > zsl->level) {

-        for (i = zsl->level; i < level; i++)
+        for (i = zsl->level; i < level; i++) {
+            rank[i] = 0;

             update[i] = zsl->header;
             update[i] = zsl->header;

+            update[i]->span[i-1] = zsl->length;
+        }

         zsl->level = level;
     }
     x = zslCreateNode(level,score,obj);
     for (i = 0; i < level; i++) {
         x->forward[i] = update[i]->forward[i];
         update[i]->forward[i] = x;
         zsl->level = level;
     }
     x = zslCreateNode(level,score,obj);
     for (i = 0; i < level; i++) {
         x->forward[i] = update[i]->forward[i];
         update[i]->forward[i] = x;

+
+        /* update span covered by update[i] as x is inserted here */
+        if (i > 0) {
+            x->span[i-1] = update[i]->span[i-1] - (rank[0] - rank[i]);
+            update[i]->span[i-1] = (rank[0] - rank[i]) + 1;
+        }

     }
     }

+
+    /* increment span for untouched levels */
+    for (i = level; i < zsl->level; i++) {
+        update[i]->span[i-1]++;
+    }
+

     x->backward = (update[0] == zsl->header) ? NULL : update[0];
     if (x->forward[0])
         x->forward[0]->backward = x;
     x->backward = (update[0] == zsl->header) ? NULL : update[0];
     if (x->forward[0])
         x->forward[0]->backward = x;


@@ -4895,12 +4972,19 @@ static int zslDelete(zskiplist *zsl, double score, robj *obj) {
     x = x->forward[0];
     if (x && score == x->score && compareStringObjects(x->obj,obj) == 0) {
         for (i = 0; i < zsl->level; i++) {
     x = x->forward[0];
     if (x && score == x->score && compareStringObjects(x->obj,obj) == 0) {
         for (i = 0; i < zsl->level; i++) {

-            if (update[i]->forward[i] != x) break;
-            update[i]->forward[i] = x->forward[i];
+            if (update[i]->forward[i] == x) {
+                if (i > 0) {
+                    update[i]->span[i-1] += x->span[i-1] - 1;
+                }
+                update[i]->forward[i] = x->forward[i];
+            } else {
+                /* invariant: i > 0, because update[0]->forward[0]
+                 * is always equal to x */
+                update[i]->span[i-1] -= 1;
+            }

         }
         if (x->forward[0]) {
         }
         if (x->forward[0]) {

-            x->forward[0]->backward = (x->backward == zsl->header) ?
-                                        NULL : x->backward;
+            x->forward[0]->backward = x->backward;

         } else {
             zsl->tail = x->backward;
         }
         } else {
             zsl->tail = x->backward;
         }


@@ -4937,12 +5021,19 @@ static unsigned long zslDeleteRange(zskiplist *zsl, double min, double max, dict
         zskiplistNode *next;
 
         for (i = 0; i < zsl->level; i++) {
         zskiplistNode *next;
 
         for (i = 0; i < zsl->level; i++) {

-            if (update[i]->forward[i] != x) break;
-            update[i]->forward[i] = x->forward[i];
+            if (update[i]->forward[i] == x) {
+                if (i > 0) {
+                    update[i]->span[i-1] += x->span[i-1] - 1;
+                }
+                update[i]->forward[i] = x->forward[i];
+            } else {
+                /* invariant: i > 0, because update[0]->forward[0]
+                 * is always equal to x */
+                update[i]->span[i-1] -= 1;
+            }

         }
         if (x->forward[0]) {
         }
         if (x->forward[0]) {

-            x->forward[0]->backward = (x->backward == zsl->header) ?
-                                        NULL : x->backward;
+            x->forward[0]->backward = x->backward;

         } else {
             zsl->tail = x->backward;
         }
         } else {
             zsl->tail = x->backward;
         }


@@ -4974,6 +5065,53 @@ static zskiplistNode *zslFirstWithScore(zskiplist *zsl, double score) {
     return x->forward[0];
 }
 
     return x->forward[0];
 }
 

+/* Find the rank for an element by both score and key.
+ * Returns 0 when the element cannot be found, rank otherwise.
+ * Note that the rank is 1-based due to the span of zsl->header to the
+ * first element. */
+static unsigned long zslGetRank(zskiplist *zsl, double score, robj *o) {
+    zskiplistNode *x;
+    unsigned long rank = 0;
+    int i;
+
+    x = zsl->header;
+    for (i = zsl->level-1; i >= 0; i--) {
+        while (x->forward[i] &&
+            (x->forward[i]->score < score ||
+                (x->forward[i]->score == score &&
+                compareStringObjects(x->forward[i]->obj,o) <= 0))) {
+            rank += i > 0 ? x->span[i-1] : 1;
+            x = x->forward[i];
+        }
+
+        /* x might be equal to zsl->header, so test if obj is non-NULL */
+        if (x->obj && compareStringObjects(x->obj,o) == 0) {
+            return rank;
+        }
+    }
+    return 0;
+}
+
+/* Finds an element by its rank. The rank argument needs to be 1-based. */
+zskiplistNode* zslGetElementByRank(zskiplist *zsl, unsigned long rank) {
+    zskiplistNode *x;
+    unsigned long traversed = 0;
+    int i;
+
+    x = zsl->header;
+    for (i = zsl->level-1; i >= 0; i--) {
+        while (x->forward[i] && (traversed + (i > 0 ? x->span[i-1] : 1)) <= rank) {
+            traversed += i > 0 ? x->span[i-1] : 1;
+            x = x->forward[i];
+        }
+
+        if (traversed == rank) {
+            return x;
+        }
+    }
+    return NULL;
+}
+

 /* The actual Z-commands implementations */
 
 /* This generic command implements both ZADD and ZINCRBY.
 /* The actual Z-commands implementations */
 
 /* This generic command implements both ZADD and ZINCRBY.


@@ -5173,17 +5311,15 @@ static void zrangeGenericCommand(redisClient *c, int reverse) {
             if (end >= llen) end = llen-1;
             rangelen = (end-start)+1;
 
             if (end >= llen) end = llen-1;
             rangelen = (end-start)+1;
 

-            /* Return the result in form of a multi-bulk reply */
+            /* check if starting point is trivial, before searching
+             * the element in log(N) time */

             if (reverse) {
             if (reverse) {

-                ln = zsl->tail;
-                while (start--)
-                    ln = ln->backward;
+                ln = start == 0 ? zsl->tail : zslGetElementByRank(zsl, llen - start);

             } else {
             } else {

-                ln = zsl->header->forward[0];
-                while (start--)
-                    ln = ln->forward[0];
+                ln = start == 0 ? zsl->header->forward[0] : zslGetElementByRank(zsl, start + 1);

             }
 
             }
 

+            /* Return the result in form of a multi-bulk reply */

             addReplySds(c,sdscatprintf(sdsempty(),"*%d\r\n",
                 withscores ? (rangelen*2) : rangelen));
             for (j = 0; j < rangelen; j++) {
             addReplySds(c,sdscatprintf(sdsempty(),"*%d\r\n",
                 withscores ? (rangelen*2) : rangelen));
             for (j = 0; j < rangelen; j++) {


@@ -5378,6 +5514,37 @@ static void zscoreCommand(redisClient *c) {
     }
 }
 
     }
 }
 

+static void zrankCommand(redisClient *c) {
+    robj *o;
+    o = lookupKeyRead(c->db,c->argv[1]);
+    if (o == NULL) {
+        addReply(c,shared.nullbulk);
+        return;
+    }
+    if (o->type != REDIS_ZSET) {
+        addReply(c,shared.wrongtypeerr);
+    } else {
+        zset *zs = o->ptr;
+        zskiplist *zsl = zs->zsl;
+        dictEntry *de;
+        unsigned long rank;
+
+        de = dictFind(zs->dict,c->argv[2]);
+        if (!de) {
+            addReply(c,shared.nullbulk);
+            return;
+        }
+
+        double *score = dictGetEntryVal(de);
+        rank = zslGetRank(zsl, *score, c->argv[2]);
+        if (rank) {
+            addReplyLong(c, rank-1);
+        } else {
+            addReply(c,shared.nullbulk);
+        }
+    }
+}
+

 /* ========================= Non type-specific commands  ==================== */
 
 static void flushdbCommand(redisClient *c) {
 /* ========================= Non type-specific commands  ==================== */
 
 static void flushdbCommand(redisClient *c) {


@@ -7416,6 +7583,7 @@ static int vmWriteObjectOnSwap(robj *o, off_t page) {
         return REDIS_ERR;
     }
     rdbSaveObject(server.vm_fp,o);
         return REDIS_ERR;
     }
     rdbSaveObject(server.vm_fp,o);

+    fflush(server.vm_fp);

     if (server.vm_enabled) pthread_mutex_unlock(&server.io_swapfile_mutex);
     return REDIS_OK;
 }
     if (server.vm_enabled) pthread_mutex_unlock(&server.io_swapfile_mutex);
     return REDIS_OK;
 }


@@ -7443,7 +7611,6 @@ static int vmSwapObjectBlocking(robj *key, robj *val) {
         (unsigned long long) page, (unsigned long long) pages);
     server.vm_stats_swapped_objects++;
     server.vm_stats_swapouts++;
         (unsigned long long) page, (unsigned long long) pages);
     server.vm_stats_swapped_objects++;
     server.vm_stats_swapouts++;

-    fflush(server.vm_fp);

     return REDIS_OK;
 }
 
     return REDIS_OK;
 }
 


@@ -8408,7 +8575,7 @@ static void *getMcontextEip(ucontext_t *uc) {
   #else
     return (void*) uc->uc_mcontext->__ss.__eip;
   #endif 
   #else
     return (void*) uc->uc_mcontext->__ss.__eip;
   #endif 

-#elif defined(__i386__) || defined(__X86_64__)  || defined(__x86_64__)
+#elif defined(__i386__) || defined(__X86_64__) || defined(__x86_64__)

     return (void*) uc->uc_mcontext.gregs[REG_EIP]; /* Linux 32/64 bit */
 #elif defined(__ia64__) /* Linux IA64 */
     return (void*) uc->uc_mcontext.sc_ip;
     return (void*) uc->uc_mcontext.gregs[REG_EIP]; /* Linux 32/64 bit */
 #elif defined(__ia64__) /* Linux IA64 */
     return (void*) uc->uc_mcontext.sc_ip;