Fixed bug in AOF rewrite not working because of integer overflow

[redis.git] / src / networking.c

diff --git a/src/networking.c b/src/networking.c
index 29eed88866fb11d26094021cd3a01bb7ad0dd697..4a6a8afd8c3cc6cd1c4abc7d58c88dd0abb1773c 100644 (file)
--- a/src/networking.c
+++ b/src/networking.c
@@ -419,7 +419,7 @@ void acceptTcpHandler(aeEventLoop *el, int fd, void *privdata, int mask) {
 
     cfd = anetTcpAccept(server.neterr, fd, cip, &cport);
     if (cfd == AE_ERR) {
 
     cfd = anetTcpAccept(server.neterr, fd, cip, &cport);
     if (cfd == AE_ERR) {

-        redisLog(REDIS_VERBOSE,"Accepting client connection: %s", server.neterr);
+        redisLog(REDIS_WARNING,"Accepting client connection: %s", server.neterr);

         return;
     }
     redisLog(REDIS_VERBOSE,"Accepted %s:%d", cip, cport);
         return;
     }
     redisLog(REDIS_VERBOSE,"Accepted %s:%d", cip, cport);


@@ -434,7 +434,7 @@ void acceptUnixHandler(aeEventLoop *el, int fd, void *privdata, int mask) {
 
     cfd = anetUnixAccept(server.neterr, fd);
     if (cfd == AE_ERR) {
 
     cfd = anetUnixAccept(server.neterr, fd);
     if (cfd == AE_ERR) {

-        redisLog(REDIS_VERBOSE,"Accepting client connection: %s", server.neterr);
+        redisLog(REDIS_WARNING,"Accepting client connection: %s", server.neterr);

         return;
     }
     redisLog(REDIS_VERBOSE,"Accepted connection to %s", server.unixsocket);
         return;
     }
     redisLog(REDIS_VERBOSE,"Accepted connection to %s", server.unixsocket);


@@ -700,70 +700,74 @@ static void setProtocolError(redisClient *c, int pos) {
 
 int processMultibulkBuffer(redisClient *c) {
     char *newline = NULL;
 
 int processMultibulkBuffer(redisClient *c) {
     char *newline = NULL;

-    char *eptr;
-    int pos = 0, tolerr;
-    long bulklen;
+    int pos = 0, ok;
+    long long ll;

 
     if (c->multibulklen == 0) {
         /* The client should have been reset */
         redisAssert(c->argc == 0);
 
         /* Multi bulk length cannot be read without a \r\n */
 
     if (c->multibulklen == 0) {
         /* The client should have been reset */
         redisAssert(c->argc == 0);
 
         /* Multi bulk length cannot be read without a \r\n */

-        newline = strstr(c->querybuf,"\r\n");
+        newline = strchr(c->querybuf,'\r');

         if (newline == NULL)
             return REDIS_ERR;
 
         if (newline == NULL)
             return REDIS_ERR;
 

+        /* Buffer should also contain \n */
+        if (newline-(c->querybuf) > ((signed)sdslen(c->querybuf)-2))
+            return REDIS_ERR;
+

         /* We know for sure there is a whole line since newline != NULL,
          * so go ahead and find out the multi bulk length. */
         redisAssert(c->querybuf[0] == '*');
         /* We know for sure there is a whole line since newline != NULL,
          * so go ahead and find out the multi bulk length. */
         redisAssert(c->querybuf[0] == '*');

-        c->multibulklen = strtol(c->querybuf+1,&eptr,10);
-        pos = (newline-c->querybuf)+2;
-        if (c->multibulklen <= 0) {
-            c->querybuf = sdsrange(c->querybuf,pos,-1);
-            return REDIS_OK;
-        } else if (c->multibulklen > 1024*1024) {
+        ok = string2ll(c->querybuf+1,newline-(c->querybuf+1),&ll);
+        if (!ok || ll > 1024*1024) {

             addReplyError(c,"Protocol error: invalid multibulk length");
             setProtocolError(c,pos);
             return REDIS_ERR;
         }
 
             addReplyError(c,"Protocol error: invalid multibulk length");
             setProtocolError(c,pos);
             return REDIS_ERR;
         }
 

+        pos = (newline-c->querybuf)+2;
+        if (ll <= 0) {
+            c->querybuf = sdsrange(c->querybuf,pos,-1);
+            return REDIS_OK;
+        }
+
+        c->multibulklen = ll;
+

         /* Setup argv array on client structure */
         if (c->argv) zfree(c->argv);
         c->argv = zmalloc(sizeof(robj*)*c->multibulklen);
         /* Setup argv array on client structure */
         if (c->argv) zfree(c->argv);
         c->argv = zmalloc(sizeof(robj*)*c->multibulklen);

-
-        /* Search new newline */
-        newline = strstr(c->querybuf+pos,"\r\n");

     }
 
     redisAssert(c->multibulklen > 0);
     while(c->multibulklen) {
         /* Read bulk length if unknown */
         if (c->bulklen == -1) {
     }
 
     redisAssert(c->multibulklen > 0);
     while(c->multibulklen) {
         /* Read bulk length if unknown */
         if (c->bulklen == -1) {

-            newline = strstr(c->querybuf+pos,"\r\n");
-            if (newline != NULL) {
-                if (c->querybuf[pos] != '$') {
-                    addReplyErrorFormat(c,
-                        "Protocol error: expected '$', got '%c'",
-                        c->querybuf[pos]);
-                    setProtocolError(c,pos);
-                    return REDIS_ERR;
-                }
+            newline = strchr(c->querybuf+pos,'\r');
+            if (newline == NULL)
+                break;

 
 

-                bulklen = strtol(c->querybuf+pos+1,&eptr,10);
-                tolerr = (eptr[0] != '\r');
-                if (tolerr || bulklen == LONG_MIN || bulklen == LONG_MAX ||
-                    bulklen < 0 || bulklen > 512*1024*1024)
-                {
-                    addReplyError(c,"Protocol error: invalid bulk length");
-                    setProtocolError(c,pos);
-                    return REDIS_ERR;
-                }
-                pos += eptr-(c->querybuf+pos)+2;
-                c->bulklen = bulklen;
-            } else {
-                /* No newline in current buffer, so wait for more data */
+            /* Buffer should also contain \n */
+            if (newline-(c->querybuf) > ((signed)sdslen(c->querybuf)-2))

                 break;
                 break;

+
+            if (c->querybuf[pos] != '$') {
+                addReplyErrorFormat(c,
+                    "Protocol error: expected '$', got '%c'",
+                    c->querybuf[pos]);
+                setProtocolError(c,pos);
+                return REDIS_ERR;

             }
             }

+
+            ok = string2ll(c->querybuf+pos+1,newline-(c->querybuf+pos+1),&ll);
+            if (!ok || ll < 0 || ll > 512*1024*1024) {
+                addReplyError(c,"Protocol error: invalid bulk length");
+                setProtocolError(c,pos);
+                return REDIS_ERR;
+            }
+
+            pos += newline-(c->querybuf+pos)+2;
+            c->bulklen = ll;

         }
 
         /* Read bulk argument */
         }
 
         /* Read bulk argument */