Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
redis
Commits
02796ba7
Commit
02796ba7
authored
Feb 15, 2013
by
antirez
Browse files
Cluster: sanity checks on the cluster bus message length.
parent
6b9c6618
Changes
2
Hide whitespace changes
Inline
Side-by-side
src/cluster.c
View file @
02796ba7
...
...
@@ -758,20 +758,33 @@ void clusterReadHandler(aeEventLoop *el, int fd, void *privdata, int mask) {
ssize_t
nread
;
clusterMsg
*
hdr
;
clusterLink
*
link
=
(
clusterLink
*
)
privdata
;
int
readlen
;
int
readlen
,
rcvbuflen
;
REDIS_NOTUSED
(
el
);
REDIS_NOTUSED
(
mask
);
again:
if
(
sdslen
(
link
->
rcvbuf
)
>=
4
)
{
hdr
=
(
clusterMsg
*
)
link
->
rcvbuf
;
readlen
=
ntohl
(
hdr
->
totlen
)
-
sdslen
(
link
->
rcvbuf
);
rcvbuflen
=
sdslen
(
link
->
rcvbuf
);
if
(
rcvbuflen
<
4
)
{
/* First, obtain the first four bytes to get the full message
* length. */
readlen
=
4
-
rcvbuflen
;
}
else
{
readlen
=
4
-
sdslen
(
link
->
rcvbuf
);
/* Finally read the full message. */
hdr
=
(
clusterMsg
*
)
link
->
rcvbuf
;
if
(
rcvbuflen
==
4
)
{
/* Perform some sanity check on the message length. */
if
(
ntohl
(
hdr
->
totlen
)
<
CLUSTERMSG_MIN_LEN
)
{
redisLog
(
REDIS_WARNING
,
"Bad message length received from Cluster bus."
);
handleLinkIOError
(
link
);
return
;
}
}
readlen
=
ntohl
(
hdr
->
totlen
)
-
rcvbuflen
;
}
nread
=
read
(
fd
,
buf
,
readlen
);
if
(
nread
==
-
1
&&
errno
==
EAGAIN
)
return
;
/*
Just no data
*/
if
(
nread
==
-
1
&&
errno
==
EAGAIN
)
return
;
/*
No more data ready.
*/
if
(
nread
<=
0
)
{
/* I/O error... */
...
...
@@ -783,17 +796,19 @@ again:
/* Read data and recast the pointer to the new buffer. */
link
->
rcvbuf
=
sdscatlen
(
link
->
rcvbuf
,
buf
,
nread
);
hdr
=
(
clusterMsg
*
)
link
->
rcvbuf
;
rcvbuflen
+=
nread
;
}
/* Total length obtained? read the payload now instead of burning
* cycles waiting for a new event to fire. */
if
(
sdslen
(
link
->
rcvbuf
)
==
4
)
goto
again
;
if
(
rcvbuf
len
==
4
)
goto
again
;
/* Whole packet in memory? We can process it. */
if
(
sdslen
(
link
->
rcvbuf
)
==
ntohl
(
hdr
->
totlen
))
{
if
(
rcvbuf
len
==
ntohl
(
hdr
->
totlen
))
{
if
(
clusterProcessPacket
(
link
))
{
sdsfree
(
link
->
rcvbuf
);
link
->
rcvbuf
=
sdsempty
();
rcvbuflen
=
0
;
/* Useless line of code currently... defensive. */
}
}
}
...
...
src/redis.h
View file @
02796ba7
...
...
@@ -637,6 +637,8 @@ typedef struct {
union
clusterMsgData
data
;
}
clusterMsg
;
#define CLUSTERMSG_MIN_LEN (sizeof(clusterMsg)-sizeof(union clusterMsgData))
/*-----------------------------------------------------------------------------
* Global server state
*----------------------------------------------------------------------------*/
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment