Commit bf9fd5ff authored by Pieter Noordhuis's avatar Pieter Noordhuis
Browse files

Check for \n after finding \r

parent 32f99c51
......@@ -712,6 +712,10 @@ int processMultibulkBuffer(redisClient *c) {
if (newline == NULL)
return REDIS_ERR;
/* Buffer should also contain \n */
if (newline-(c->querybuf) > ((signed)sdslen(c->querybuf)-2))
return REDIS_ERR;
/* We know for sure there is a whole line since newline != NULL,
* so go ahead and find out the multi bulk length. */
redisAssert(c->querybuf[0] == '*');
......@@ -733,9 +737,6 @@ int processMultibulkBuffer(redisClient *c) {
/* Setup argv array on client structure */
if (c->argv) zfree(c->argv);
c->argv = zmalloc(sizeof(robj*)*c->multibulklen);
/* Search new newline */
newline = strchr(c->querybuf+pos,'\r');
}
redisAssert(c->multibulklen > 0);
......@@ -743,7 +744,13 @@ int processMultibulkBuffer(redisClient *c) {
/* Read bulk length if unknown */
if (c->bulklen == -1) {
newline = strchr(c->querybuf+pos,'\r');
if (newline != NULL) {
if (newline == NULL)
break;
/* Buffer should also contain \n */
if (newline-(c->querybuf) > ((signed)sdslen(c->querybuf)-2))
break;
if (c->querybuf[pos] != '$') {
addReplyErrorFormat(c,
"Protocol error: expected '$', got '%c'",
......@@ -758,12 +765,9 @@ int processMultibulkBuffer(redisClient *c) {
setProtocolError(c,pos);
return REDIS_ERR;
}
pos += newline-(c->querybuf+pos)+2;
c->bulklen = ll;
} else {
/* No newline in current buffer, so wait for more data */
break;
}
}
/* Read bulk argument */
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment