X-Git-Url: https://git.saurik.com/redis.git/blobdiff_plain/5af302011c80076447403b454c781cf210d1d715..38a154a9a6244826a8cb536347a60749cef2ee4a:/src/networking.c

diff --git a/src/networking.c b/src/networking.c
index 9d41b380..4a6a8afd 100644
--- a/src/networking.c
+++ b/src/networking.c
@@ -419,7 +419,7 @@ void acceptTcpHandler(aeEventLoop *el, int fd, void *privdata, int mask) {
 
     cfd = anetTcpAccept(server.neterr, fd, cip, &cport);
     if (cfd == AE_ERR) {
-        redisLog(REDIS_VERBOSE,"Accepting client connection: %s", server.neterr);
+        redisLog(REDIS_WARNING,"Accepting client connection: %s", server.neterr);
         return;
     }
     redisLog(REDIS_VERBOSE,"Accepted %s:%d", cip, cport);
@@ -434,7 +434,7 @@ void acceptUnixHandler(aeEventLoop *el, int fd, void *privdata, int mask) {
 
     cfd = anetUnixAccept(server.neterr, fd);
     if (cfd == AE_ERR) {
-        redisLog(REDIS_VERBOSE,"Accepting client connection: %s", server.neterr);
+        redisLog(REDIS_WARNING,"Accepting client connection: %s", server.neterr);
         return;
     }
     redisLog(REDIS_VERBOSE,"Accepted connection to %s", server.unixsocket);
@@ -712,6 +712,10 @@ int processMultibulkBuffer(redisClient *c) {
         if (newline == NULL)
             return REDIS_ERR;
 
+        /* Buffer should also contain \n */
+        if (newline-(c->querybuf) > ((signed)sdslen(c->querybuf)-2))
+            return REDIS_ERR;
+
         /* We know for sure there is a whole line since newline != NULL,
          * so go ahead and find out the multi bulk length. */
         redisAssert(c->querybuf[0] == '*');
@@ -720,21 +724,19 @@ int processMultibulkBuffer(redisClient *c) {
             addReplyError(c,"Protocol error: invalid multibulk length");
             setProtocolError(c,pos);
             return REDIS_ERR;
-        } else {
-            pos = (newline-c->querybuf)+2;
-            if (ll <= 0) {
-                c->querybuf = sdsrange(c->querybuf,pos,-1);
-                return REDIS_OK;
-            }
         }
+
+        pos = (newline-c->querybuf)+2;
+        if (ll <= 0) {
+            c->querybuf = sdsrange(c->querybuf,pos,-1);
+            return REDIS_OK;
+        }
+
         c->multibulklen = ll;
 
         /* Setup argv array on client structure */
         if (c->argv) zfree(c->argv);
         c->argv = zmalloc(sizeof(robj*)*c->multibulklen);
-
-        /* Search new newline */
-        newline = strchr(c->querybuf+pos,'\r');
     }
 
     redisAssert(c->multibulklen > 0);
@@ -742,27 +744,30 @@ int processMultibulkBuffer(redisClient *c) {
         /* Read bulk length if unknown */
         if (c->bulklen == -1) {
             newline = strchr(c->querybuf+pos,'\r');
-            if (newline != NULL) {
-                if (c->querybuf[pos] != '$') {
-                    addReplyErrorFormat(c,
-                        "Protocol error: expected '$', got '%c'",
-                        c->querybuf[pos]);
-                    setProtocolError(c,pos);
-                    return REDIS_ERR;
-                }
+            if (newline == NULL)
+                break;
 
-                ok = string2ll(c->querybuf+pos+1,newline-(c->querybuf+pos+1),&ll);
-                if (!ok || ll < 0 || ll > 512*1024*1024) {
-                    addReplyError(c,"Protocol error: invalid bulk length");
-                    setProtocolError(c,pos);
-                    return REDIS_ERR;
-                }
-                pos += newline-(c->querybuf+pos)+2;
-                c->bulklen = ll;
-            } else {
-                /* No newline in current buffer, so wait for more data */
+            /* Buffer should also contain \n */
+            if (newline-(c->querybuf) > ((signed)sdslen(c->querybuf)-2))
                 break;
+
+            if (c->querybuf[pos] != '$') {
+                addReplyErrorFormat(c,
+                    "Protocol error: expected '$', got '%c'",
+                    c->querybuf[pos]);
+                setProtocolError(c,pos);
+                return REDIS_ERR;
+            }
+
+            ok = string2ll(c->querybuf+pos+1,newline-(c->querybuf+pos+1),&ll);
+            if (!ok || ll < 0 || ll > 512*1024*1024) {
+                addReplyError(c,"Protocol error: invalid bulk length");
+                setProtocolError(c,pos);
+                return REDIS_ERR;
             }
+
+            pos += newline-(c->querybuf+pos)+2;
+            c->bulklen = ll;
         }
 
         /* Read bulk argument */