Fix for ZUNIONSTORE bug when there is an empty set among input sets. Regression test...

[redis.git] / src / networking.c

diff --git a/src/networking.c b/src/networking.c
index 48febb09ce26a89080cadde4ce584f8ae2610933..4a6a8afd8c3cc6cd1c4abc7d58c88dd0abb1773c 100644 (file)
--- a/src/networking.c
+++ b/src/networking.c
@@ -419,7 +419,7 @@ void acceptTcpHandler(aeEventLoop *el, int fd, void *privdata, int mask) {
 
     cfd = anetTcpAccept(server.neterr, fd, cip, &cport);
     if (cfd == AE_ERR) {
 
     cfd = anetTcpAccept(server.neterr, fd, cip, &cport);
     if (cfd == AE_ERR) {

-        redisLog(REDIS_VERBOSE,"Accepting client connection: %s", server.neterr);
+        redisLog(REDIS_WARNING,"Accepting client connection: %s", server.neterr);

         return;
     }
     redisLog(REDIS_VERBOSE,"Accepted %s:%d", cip, cport);
         return;
     }
     redisLog(REDIS_VERBOSE,"Accepted %s:%d", cip, cport);


@@ -434,7 +434,7 @@ void acceptUnixHandler(aeEventLoop *el, int fd, void *privdata, int mask) {
 
     cfd = anetUnixAccept(server.neterr, fd);
     if (cfd == AE_ERR) {
 
     cfd = anetUnixAccept(server.neterr, fd);
     if (cfd == AE_ERR) {

-        redisLog(REDIS_VERBOSE,"Accepting client connection: %s", server.neterr);
+        redisLog(REDIS_WARNING,"Accepting client connection: %s", server.neterr);

         return;
     }
     redisLog(REDIS_VERBOSE,"Accepted connection to %s", server.unixsocket);
         return;
     }
     redisLog(REDIS_VERBOSE,"Accepted connection to %s", server.unixsocket);


@@ -712,6 +712,10 @@ int processMultibulkBuffer(redisClient *c) {
         if (newline == NULL)
             return REDIS_ERR;
 
         if (newline == NULL)
             return REDIS_ERR;
 

+        /* Buffer should also contain \n */
+        if (newline-(c->querybuf) > ((signed)sdslen(c->querybuf)-2))
+            return REDIS_ERR;
+

         /* We know for sure there is a whole line since newline != NULL,
          * so go ahead and find out the multi bulk length. */
         redisAssert(c->querybuf[0] == '*');
         /* We know for sure there is a whole line since newline != NULL,
          * so go ahead and find out the multi bulk length. */
         redisAssert(c->querybuf[0] == '*');


@@ -733,9 +737,6 @@ int processMultibulkBuffer(redisClient *c) {
         /* Setup argv array on client structure */
         if (c->argv) zfree(c->argv);
         c->argv = zmalloc(sizeof(robj*)*c->multibulklen);
         /* Setup argv array on client structure */
         if (c->argv) zfree(c->argv);
         c->argv = zmalloc(sizeof(robj*)*c->multibulklen);

-
-        /* Search new newline */
-        newline = strchr(c->querybuf+pos,'\r');

     }
 
     redisAssert(c->multibulklen > 0);
     }
 
     redisAssert(c->multibulklen > 0);


@@ -743,27 +744,30 @@ int processMultibulkBuffer(redisClient *c) {
         /* Read bulk length if unknown */
         if (c->bulklen == -1) {
             newline = strchr(c->querybuf+pos,'\r');
         /* Read bulk length if unknown */
         if (c->bulklen == -1) {
             newline = strchr(c->querybuf+pos,'\r');

-            if (newline != NULL) {
-                if (c->querybuf[pos] != '$') {
-                    addReplyErrorFormat(c,
-                        "Protocol error: expected '$', got '%c'",
-                        c->querybuf[pos]);
-                    setProtocolError(c,pos);
-                    return REDIS_ERR;
-                }
+            if (newline == NULL)
+                break;

 
 

-                ok = string2ll(c->querybuf+pos+1,newline-(c->querybuf+pos+1),&ll);
-                if (!ok || ll < 0 || ll > 512*1024*1024) {
-                    addReplyError(c,"Protocol error: invalid bulk length");
-                    setProtocolError(c,pos);
-                    return REDIS_ERR;
-                }
-                pos += newline-(c->querybuf+pos)+2;
-                c->bulklen = ll;
-            } else {
-                /* No newline in current buffer, so wait for more data */
+            /* Buffer should also contain \n */
+            if (newline-(c->querybuf) > ((signed)sdslen(c->querybuf)-2))

                 break;
                 break;

+
+            if (c->querybuf[pos] != '$') {
+                addReplyErrorFormat(c,
+                    "Protocol error: expected '$', got '%c'",
+                    c->querybuf[pos]);
+                setProtocolError(c,pos);
+                return REDIS_ERR;

             }
             }

+
+            ok = string2ll(c->querybuf+pos+1,newline-(c->querybuf+pos+1),&ll);
+            if (!ok || ll < 0 || ll > 512*1024*1024) {
+                addReplyError(c,"Protocol error: invalid bulk length");
+                setProtocolError(c,pos);
+                return REDIS_ERR;
+            }
+
+            pos += newline-(c->querybuf+pos)+2;
+            c->bulklen = ll;

         }
 
         /* Read bulk argument */
         }
 
         /* Read bulk argument */