Comments about security of slave-read-only in redis.coinf.

[redis.git] / src / t_hash.c

diff --git a/src/t_hash.c b/src/t_hash.c
index 9699223a8f02dd36e44fae6bbb6095e42b199631..b3928450533d2f0732010925db980a2f4ca2e0d1 100644 (file)
--- a/src/t_hash.c
+++ b/src/t_hash.c
@@ -47,23 +47,18 @@ int hashTypeGetFromZiplist(robj *o, robj *field,
 
     zl = o->ptr;
     fptr = ziplistIndex(zl, ZIPLIST_HEAD);
-    while (fptr != NULL) {
-        /* Grab pointer to the value (fptr points to the field) */
-        vptr = ziplistNext(zl, fptr);
-        redisAssert(vptr != NULL);
-
-        /* Compare field in ziplist with specified field */
-        if (ziplistCompare(fptr, field->ptr, sdslen(field->ptr))) {
-            break;
+    if (fptr != NULL) {
+        fptr = ziplistFind(fptr, field->ptr, sdslen(field->ptr), 1);
+        if (fptr != NULL) {
+            /* Grab pointer to the value (fptr points to the field) */
+            vptr = ziplistNext(zl, fptr);
+            redisAssert(vptr != NULL);
         }
-
-        /* Skip over value */
-        fptr = ziplistNext(zl, vptr);
     }
 
     decrRefCount(field);
 
-    if (fptr != NULL) {
+    if (vptr != NULL) {
         ret = ziplistGet(vptr, vstr, vlen, vll);
         redisAssert(ret);
         return 0;
@@ -80,10 +75,7 @@ int hashTypeGetFromHashTable(robj *o, robj *field, robj **value) {
     redisAssert(o->encoding == REDIS_ENCODING_HT);
 
     de = dictFind(o->ptr, field);
-    if (de == NULL) {
-        return -1;
-    }
-
+    if (de == NULL) return -1;
     *value = dictGetVal(de);
     return 0;
 }
@@ -117,11 +109,9 @@ robj *hashTypeGetObject(robj *o, robj *field) {
             incrRefCount(aux);
             value = aux;
         }
-
     } else {
         redisPanic("Unknown hash encoding");
     }
-
     return value;
 }
 
@@ -133,21 +123,14 @@ int hashTypeExists(robj *o, robj *field) {
         unsigned int vlen = UINT_MAX;
         long long vll = LLONG_MAX;
 
-        if (hashTypeGetFromZiplist(o, field, &vstr, &vlen, &vll) == 0) {
-            return 1;
-        }
-
+        if (hashTypeGetFromZiplist(o, field, &vstr, &vlen, &vll) == 0) return 1;
     } else if (o->encoding == REDIS_ENCODING_HT) {
         robj *aux;
 
-        if (hashTypeGetFromHashTable(o, field, &aux) == 0) {
-            return 1;
-        }
-
+        if (hashTypeGetFromHashTable(o, field, &aux) == 0) return 1;
     } else {
         redisPanic("Unknown hash encoding");
     }
-
     return 0;
 }
 
@@ -164,27 +147,28 @@ int hashTypeSet(robj *o, robj *field, robj *value) {
 
         zl = o->ptr;
         fptr = ziplistIndex(zl, ZIPLIST_HEAD);
-        while (fptr != NULL) {
-            /* Compare field in ziplist with specified field */
-            if (ziplistCompare(fptr, field->ptr, sdslen(field->ptr))) {
-                zl = ziplistDelete(zl,&fptr);
-                zl = ziplistDelete(zl,&fptr);
-                o->ptr = zl;
+        if (fptr != NULL) {
+            fptr = ziplistFind(fptr, field->ptr, sdslen(field->ptr), 1);
+            if (fptr != NULL) {
+                /* Grab pointer to the value (fptr points to the field) */
+                vptr = ziplistNext(zl, fptr);
+                redisAssert(vptr != NULL);
                 update = 1;
-                break;
-            }
 
-            /* Grab pointer to the value (fptr points to the field) */
-            vptr = ziplistNext(zl, fptr);
-            redisAssert(vptr != NULL);
+                /* Delete value */
+                zl = ziplistDelete(zl, &vptr);
 
-            /* Grab pointer (if any) to the next field */
-            fptr = ziplistNext(zl, vptr);
+                /* Insert new value */
+                zl = ziplistInsert(zl, vptr, value->ptr, sdslen(value->ptr));
+            }
+        }
+
+        if (!update) {
+            /* Push new field/value pair onto the tail of the ziplist */
+            zl = ziplistPush(zl, field->ptr, sdslen(field->ptr), ZIPLIST_TAIL);
+            zl = ziplistPush(zl, value->ptr, sdslen(value->ptr), ZIPLIST_TAIL);
         }
 
-        /* Push new field/value pair onto the tail of the ziplist */
-        zl = ziplistPush(zl, field->ptr, sdslen(field->ptr), ZIPLIST_TAIL);
-        zl = ziplistPush(zl, value->ptr, sdslen(value->ptr), ZIPLIST_TAIL);
         o->ptr = zl;
 
         decrRefCount(field);
@@ -217,28 +201,20 @@ int hashTypeDelete(robj *o, robj *field) {
     int deleted = 0;
 
     if (o->encoding == REDIS_ENCODING_ZIPLIST) {
-        unsigned char *zl, *fptr, *vptr;
+        unsigned char *zl, *fptr;
 
         field = getDecodedObject(field);
 
         zl = o->ptr;
         fptr = ziplistIndex(zl, ZIPLIST_HEAD);
-        while (fptr != NULL) {
-            /* Compare field in ziplist with specified field */
-            if (ziplistCompare(fptr, field->ptr, sdslen(field->ptr))) {
+        if (fptr != NULL) {
+            fptr = ziplistFind(fptr, field->ptr, sdslen(field->ptr), 1);
+            if (fptr != NULL) {
                 zl = ziplistDelete(zl,&fptr);
                 zl = ziplistDelete(zl,&fptr);
                 o->ptr = zl;
                 deleted = 1;
-                break;
             }
-
-            /* Grab pointer to the value (fptr points to the field) */
-            vptr = ziplistNext(zl, fptr);
-            redisAssert(vptr != NULL);
-
-            /* Grab pointer (if any) to the next field */
-            fptr = ziplistNext(zl, vptr);
         }
 
         decrRefCount(field);
@@ -318,10 +294,7 @@ int hashTypeNext(hashTypeIterator *hi) {
             redisAssert(vptr != NULL);
             fptr = ziplistNext(zl, vptr);
         }
-
-        if (fptr == NULL) {
-            return REDIS_ERR;
-        }
+        if (fptr == NULL) return REDIS_ERR;
 
         /* Grab pointer to the value (fptr points to the field) */
         vptr = ziplistNext(zl, fptr);
@@ -330,16 +303,11 @@ int hashTypeNext(hashTypeIterator *hi) {
         /* fptr, vptr now point to the first or next pair */
         hi->fptr = fptr;
         hi->vptr = vptr;
-
     } else if (hi->encoding == REDIS_ENCODING_HT) {
-        if ((hi->de = dictNext(hi->di)) == NULL) {
-            return REDIS_ERR;
-        }
-
+        if ((hi->de = dictNext(hi->di)) == NULL) return REDIS_ERR;
     } else {
         redisPanic("Unknown hash encoding");
     }
-
     return REDIS_OK;
 }
 
@@ -518,7 +486,7 @@ void hmsetCommand(redisClient *c) {
 }
 
 void hincrbyCommand(redisClient *c) {
-    long long value, incr;
+    long long value, incr, oldvalue;
     robj *o, *current, *new;
 
     if (getLongLongFromObjectOrReply(c,c->argv[3],&incr,NULL) != REDIS_OK) return;
@@ -534,6 +502,12 @@ void hincrbyCommand(redisClient *c) {
         value = 0;
     }
 
+    oldvalue = value;
+    if ((incr < 0 && oldvalue < 0 && incr < (LLONG_MIN-oldvalue)) ||
+        (incr > 0 && oldvalue > 0 && incr > (LLONG_MAX-oldvalue))) {
+        addReplyError(c,"increment or decrement would overflow");
+        return;
+    }
     value += incr;
     new = createStringObjectFromLongLong(value);
     hashTypeTryObjectEncoding(o,&c->argv[2],NULL);