Fixed bug in AOF rewrite not working because of integer overflow

[redis.git] / src / networking.c

diff --git a/src/networking.c b/src/networking.c
index 32d071bdecffe6b50532507be2c2988f4678d0a6..4a6a8afd8c3cc6cd1c4abc7d58c88dd0abb1773c 100644 (file)
--- a/src/networking.c
+++ b/src/networking.c
@@ -419,7 +419,7 @@ void acceptTcpHandler(aeEventLoop *el, int fd, void *privdata, int mask) {
 
     cfd = anetTcpAccept(server.neterr, fd, cip, &cport);
     if (cfd == AE_ERR) {
-        redisLog(REDIS_VERBOSE,"Accepting client connection: %s", server.neterr);
+        redisLog(REDIS_WARNING,"Accepting client connection: %s", server.neterr);
         return;
     }
     redisLog(REDIS_VERBOSE,"Accepted %s:%d", cip, cport);
@@ -434,7 +434,7 @@ void acceptUnixHandler(aeEventLoop *el, int fd, void *privdata, int mask) {
 
     cfd = anetUnixAccept(server.neterr, fd);
     if (cfd == AE_ERR) {
-        redisLog(REDIS_VERBOSE,"Accepting client connection: %s", server.neterr);
+        redisLog(REDIS_WARNING,"Accepting client connection: %s", server.neterr);
         return;
     }
     redisLog(REDIS_VERBOSE,"Accepted connection to %s", server.unixsocket);
@@ -526,10 +526,16 @@ void freeClient(redisClient *c) {
          * close the connection with all our slaves if we have any, so
          * when we'll resync with the master the other slaves will sync again
          * with us as well. Note that also when the slave is not connected
-         * to the master it will keep refusing connections by other slaves. */
-        while (listLength(server.slaves)) {
-            ln = listFirst(server.slaves);
-            freeClient((redisClient*)ln->value);
+         * to the master it will keep refusing connections by other slaves.
+         *
+         * We do this only if server.masterhost != NULL. If it is NULL this
+         * means the user called SLAVEOF NO ONE and we are freeing our
+         * link with the master, so no need to close link with slaves. */
+        if (server.masterhost != NULL) {
+            while (listLength(server.slaves)) {
+                ln = listFirst(server.slaves);
+                freeClient((redisClient*)ln->value);
+            }
         }
     }
     /* Release memory */
@@ -694,70 +700,74 @@ static void setProtocolError(redisClient *c, int pos) {
 
 int processMultibulkBuffer(redisClient *c) {
     char *newline = NULL;
-    char *eptr;
-    int pos = 0, tolerr;
-    long bulklen;
+    int pos = 0, ok;
+    long long ll;
 
     if (c->multibulklen == 0) {
         /* The client should have been reset */
         redisAssert(c->argc == 0);
 
         /* Multi bulk length cannot be read without a \r\n */
-        newline = strstr(c->querybuf,"\r\n");
+        newline = strchr(c->querybuf,'\r');
         if (newline == NULL)
             return REDIS_ERR;
 
+        /* Buffer should also contain \n */
+        if (newline-(c->querybuf) > ((signed)sdslen(c->querybuf)-2))
+            return REDIS_ERR;
+
         /* We know for sure there is a whole line since newline != NULL,
          * so go ahead and find out the multi bulk length. */
         redisAssert(c->querybuf[0] == '*');
-        c->multibulklen = strtol(c->querybuf+1,&eptr,10);
-        pos = (newline-c->querybuf)+2;
-        if (c->multibulklen <= 0) {
-            c->querybuf = sdsrange(c->querybuf,pos,-1);
-            return REDIS_OK;
-        } else if (c->multibulklen > 1024*1024) {
+        ok = string2ll(c->querybuf+1,newline-(c->querybuf+1),&ll);
+        if (!ok || ll > 1024*1024) {
             addReplyError(c,"Protocol error: invalid multibulk length");
             setProtocolError(c,pos);
             return REDIS_ERR;
         }
 
+        pos = (newline-c->querybuf)+2;
+        if (ll <= 0) {
+            c->querybuf = sdsrange(c->querybuf,pos,-1);
+            return REDIS_OK;
+        }
+
+        c->multibulklen = ll;
+
         /* Setup argv array on client structure */
         if (c->argv) zfree(c->argv);
         c->argv = zmalloc(sizeof(robj*)*c->multibulklen);
-
-        /* Search new newline */
-        newline = strstr(c->querybuf+pos,"\r\n");
     }
 
     redisAssert(c->multibulklen > 0);
     while(c->multibulklen) {
         /* Read bulk length if unknown */
         if (c->bulklen == -1) {
-            newline = strstr(c->querybuf+pos,"\r\n");
-            if (newline != NULL) {
-                if (c->querybuf[pos] != '$') {
-                    addReplyErrorFormat(c,
-                        "Protocol error: expected '$', got '%c'",
-                        c->querybuf[pos]);
-                    setProtocolError(c,pos);
-                    return REDIS_ERR;
-                }
+            newline = strchr(c->querybuf+pos,'\r');
+            if (newline == NULL)
+                break;
 
-                bulklen = strtol(c->querybuf+pos+1,&eptr,10);
-                tolerr = (eptr[0] != '\r');
-                if (tolerr || bulklen == LONG_MIN || bulklen == LONG_MAX ||
-                    bulklen < 0 || bulklen > 512*1024*1024)
-                {
-                    addReplyError(c,"Protocol error: invalid bulk length");
-                    setProtocolError(c,pos);
-                    return REDIS_ERR;
-                }
-                pos += eptr-(c->querybuf+pos)+2;
-                c->bulklen = bulklen;
-            } else {
-                /* No newline in current buffer, so wait for more data */
+            /* Buffer should also contain \n */
+            if (newline-(c->querybuf) > ((signed)sdslen(c->querybuf)-2))
                 break;
+
+            if (c->querybuf[pos] != '$') {
+                addReplyErrorFormat(c,
+                    "Protocol error: expected '$', got '%c'",
+                    c->querybuf[pos]);
+                setProtocolError(c,pos);
+                return REDIS_ERR;
             }
+
+            ok = string2ll(c->querybuf+pos+1,newline-(c->querybuf+pos+1),&ll);
+            if (!ok || ll < 0 || ll > 512*1024*1024) {
+                addReplyError(c,"Protocol error: invalid bulk length");
+                setProtocolError(c,pos);
+                return REDIS_ERR;
+            }
+
+            pos += newline-(c->querybuf+pos)+2;
+            c->bulklen = ll;
         }
 
         /* Read bulk argument */