A fix for an invalid access when VM is disabled

[redis.git] / redis.c

diff --git a/redis.c b/redis.c
index bff1cdfc548adf64050f4540822b548fcabc23c2..c6283e498d13337c1c986d5bc5b173da3f386e4b 100644 (file)
--- a/redis.c
+++ b/redis.c
@@ -3536,7 +3536,7 @@ static void setGenericCommand(redisClient *c, int nx) {
              * to overwrite the old. So we delete the old key in the database.
              * This will also make sure that swap pages about the old object
              * will be marked as free. */
-            if (deleteIfSwapped(c->db,c->argv[1]))
+            if (server.vm_enabled && deleteIfSwapped(c->db,c->argv[1]))
                 incrRefCount(c->argv[1]);
             dictReplace(c->db->dict,c->argv[1],c->argv[2]);
             incrRefCount(c->argv[2]);
@@ -4075,7 +4075,7 @@ static void pushGenericCommand(redisClient *c, int where) {
     lobj = lookupKeyWrite(c->db,c->argv[1]);
     if (lobj == NULL) {
         if (handleClientsWaitingListPush(c,c->argv[1],c->argv[2])) {
-            addReply(c,shared.ok);
+            addReply(c,shared.cone);
             return;
         }
         lobj = createListObject();
@@ -4094,7 +4094,7 @@ static void pushGenericCommand(redisClient *c, int where) {
             return;
         }
         if (handleClientsWaitingListPush(c,c->argv[1],c->argv[2])) {
-            addReply(c,shared.ok);
+            addReply(c,shared.cone);
             return;
         }
         list = lobj->ptr;
@@ -4106,7 +4106,7 @@ static void pushGenericCommand(redisClient *c, int where) {
         incrRefCount(c->argv[2]);
     }
     server.dirty++;
-    addReply(c,shared.ok);
+    addReplySds(c,sdscatprintf(sdsempty(),":%d\r\n",listLength(list)));
 }
 
 static void lpushCommand(redisClient *c) {
@@ -4844,7 +4844,8 @@ static zskiplistNode *zslCreateNode(int level, double score, robj *obj) {
     zskiplistNode *zn = zmalloc(sizeof(*zn));
 
     zn->forward = zmalloc(sizeof(zskiplistNode*) * level);
-    zn->span = zmalloc(sizeof(unsigned int) * level);
+    if (level > 0)
+        zn->span = zmalloc(sizeof(unsigned int) * (level - 1));
     zn->score = score;
     zn->obj = obj;
     return zn;
@@ -4897,19 +4898,19 @@ static int zslRandomLevel(void) {
 
 static void zslInsert(zskiplist *zsl, double score, robj *obj) {
     zskiplistNode *update[ZSKIPLIST_MAXLEVEL], *x;
-    unsigned int span[ZSKIPLIST_MAXLEVEL];
+    unsigned int rank[ZSKIPLIST_MAXLEVEL];
     int i, level;
 
     x = zsl->header;
     for (i = zsl->level-1; i >= 0; i--) {
-        /* store span that is crossed to reach the insert position */
-        span[i] = i == (zsl->level-1) ? 0 : span[i+1];
+        /* store rank that is crossed to reach the insert position */
+        rank[i] = i == (zsl->level-1) ? 0 : rank[i+1];
 
         while (x->forward[i] &&
             (x->forward[i]->score < score ||
                 (x->forward[i]->score == score &&
                 compareStringObjects(x->forward[i]->obj,obj) < 0))) {
-            span[i] += x->span[i];
+            rank[i] += i > 0 ? x->span[i-1] : 1;
             x = x->forward[i];
         }
         update[i] = x;
@@ -4921,9 +4922,9 @@ static void zslInsert(zskiplist *zsl, double score, robj *obj) {
     level = zslRandomLevel();
     if (level > zsl->level) {
         for (i = zsl->level; i < level; i++) {
-            span[i] = 0;
+            rank[i] = 0;
             update[i] = zsl->header;
-            update[i]->span[i] = zsl->length;
+            update[i]->span[i-1] = zsl->length;
         }
         zsl->level = level;
     }
@@ -4933,13 +4934,15 @@ static void zslInsert(zskiplist *zsl, double score, robj *obj) {
         update[i]->forward[i] = x;
 
         /* update span covered by update[i] as x is inserted here */
-        x->span[i] = update[i]->span[i] - (span[0] - span[i]);
-        update[i]->span[i] = (span[0] - span[i]) + 1;
+        if (i > 0) {
+            x->span[i-1] = update[i]->span[i-1] - (rank[0] - rank[i]);
+            update[i]->span[i-1] = (rank[0] - rank[i]) + 1;
+        }
     }
 
     /* increment span for untouched levels */
     for (i = level; i < zsl->level; i++) {
-        update[i]->span[i]++;
+        update[i]->span[i-1]++;
     }
 
     x->backward = (update[0] == zsl->header) ? NULL : update[0];
@@ -4970,10 +4973,14 @@ static int zslDelete(zskiplist *zsl, double score, robj *obj) {
     if (x && score == x->score && compareStringObjects(x->obj,obj) == 0) {
         for (i = 0; i < zsl->level; i++) {
             if (update[i]->forward[i] == x) {
-                update[i]->span[i] += x->span[i] - 1;
+                if (i > 0) {
+                    update[i]->span[i-1] += x->span[i-1] - 1;
+                }
                 update[i]->forward[i] = x->forward[i];
             } else {
-                update[i]->span[i] -= 1;
+                /* invariant: i > 0, because update[0]->forward[0]
+                 * is always equal to x */
+                update[i]->span[i-1] -= 1;
             }
         }
         if (x->forward[0]) {
@@ -5015,10 +5022,14 @@ static unsigned long zslDeleteRange(zskiplist *zsl, double min, double max, dict
 
         for (i = 0; i < zsl->level; i++) {
             if (update[i]->forward[i] == x) {
-                update[i]->span[i] += x->span[i] - 1;
+                if (i > 0) {
+                    update[i]->span[i-1] += x->span[i-1] - 1;
+                }
                 update[i]->forward[i] = x->forward[i];
             } else {
-                update[i]->span[i] -= 1;
+                /* invariant: i > 0, because update[0]->forward[0]
+                 * is always equal to x */
+                update[i]->span[i-1] -= 1;
             }
         }
         if (x->forward[0]) {
@@ -5069,7 +5080,7 @@ static unsigned long zslGetRank(zskiplist *zsl, double score, robj *o) {
             (x->forward[i]->score < score ||
                 (x->forward[i]->score == score &&
                 compareStringObjects(x->forward[i]->obj,o) <= 0))) {
-            rank += x->span[i];
+            rank += i > 0 ? x->span[i-1] : 1;
             x = x->forward[i];
         }
 
@@ -5089,8 +5100,8 @@ zskiplistNode* zslGetElementByRank(zskiplist *zsl, unsigned long rank) {
 
     x = zsl->header;
     for (i = zsl->level-1; i >= 0; i--) {
-        while (x->forward[i] && (traversed + x->span[i]) <= rank) {
-            traversed += x->span[i];
+        while (x->forward[i] && (traversed + (i > 0 ? x->span[i-1] : 1)) <= rank) {
+            traversed += i > 0 ? x->span[i-1] : 1;
             x = x->forward[i];
         }