Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
redis
Commits
02796ba7
Commit
02796ba7
authored
Feb 15, 2013
by
antirez
Browse files
Cluster: sanity checks on the cluster bus message length.
parent
6b9c6618
Changes
2
Show whitespace changes
Inline
Side-by-side
src/cluster.c
View file @
02796ba7
...
...
@@ -758,20 +758,33 @@ void clusterReadHandler(aeEventLoop *el, int fd, void *privdata, int mask) {
ssize_t nread;
clusterMsg *hdr;
clusterLink *link = (clusterLink*) privdata;
int
readlen
;
int readlen
, rcvbuflen
;
REDIS_NOTUSED(el);
REDIS_NOTUSED(mask);
again:
if
(
sdslen
(
link
->
rcvbuf
)
>=
4
)
{
hdr
=
(
clusterMsg
*
)
link
->
rcvbuf
;
readlen
=
ntohl
(
hdr
->
totlen
)
-
sdslen
(
link
->
rcvbuf
);
rcvbuflen = sdslen(link->rcvbuf);
if (rcvbuflen < 4) {
/* First, obtain the first four bytes to get the full message
* length. */
readlen = 4 - rcvbuflen;
} else {
readlen
=
4
-
sdslen
(
link
->
rcvbuf
);
/* Finally read the full message. */
hdr = (clusterMsg*) link->rcvbuf;
if (rcvbuflen == 4) {
/* Perform some sanity check on the message length. */
if (ntohl(hdr->totlen) < CLUSTERMSG_MIN_LEN) {
redisLog(REDIS_WARNING,
"Bad message length received from Cluster bus.");
handleLinkIOError(link);
return;
}
}
readlen = ntohl(hdr->totlen) - rcvbuflen;
}
nread = read(fd,buf,readlen);
if
(
nread
==
-
1
&&
errno
==
EAGAIN
)
return
;
/*
Just no data
*/
if (nread == -1 && errno == EAGAIN) return; /*
No more data ready.
*/
if (nread <= 0) {
/* I/O error... */
...
...
@@ -783,17 +796,19 @@ again:
/* Read data and recast the pointer to the new buffer. */
link->rcvbuf = sdscatlen(link->rcvbuf,buf,nread);
hdr = (clusterMsg*) link->rcvbuf;
rcvbuflen += nread;
}
/* Total length obtained? read the payload now instead of burning
* cycles waiting for a new event to fire. */
if
(
sdslen
(
link
->
rcvbuf
)
==
4
)
goto
again
;
if (rcvbuf
len
== 4) goto again;
/* Whole packet in memory? We can process it. */
if
(
sdslen
(
link
->
rcvbuf
)
==
ntohl
(
hdr
->
totlen
))
{
if (rcvbuf
len
== ntohl(hdr->totlen)) {
if (clusterProcessPacket(link)) {
sdsfree(link->rcvbuf);
link->rcvbuf = sdsempty();
rcvbuflen = 0; /* Useless line of code currently... defensive. */
}
}
}
...
...
src/redis.h
View file @
02796ba7
...
...
@@ -637,6 +637,8 @@ typedef struct {
union
clusterMsgData
data
;
}
clusterMsg
;
#define CLUSTERMSG_MIN_LEN (sizeof(clusterMsg)-sizeof(union clusterMsgData))
/*-----------------------------------------------------------------------------
* Global server state
*----------------------------------------------------------------------------*/
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment