- 01 Feb, 2017 1 commit
-
-
antirez authored
Ziplists had a bug that was discovered while investigating a different issue, resulting in a corrupted ziplist representation, and a likely segmentation foult and/or data corruption of the last element of the ziplist, once the ziplist is accessed again. The bug happens when a specific set of insertions / deletions is performed so that an entry is encoded to have a "prevlen" field (the length of the previous entry) of 5 bytes but with a count that could be encoded in a "prevlen" field of a since byte. This could happen when the "cascading update" process called by ziplistInsert()/ziplistDelete() in certain contitious forces the prevlen to be bigger than necessary in order to avoid too much data moving around. Once such an entry is generated, inserting a very small entry immediately before it will result in a resizing of the ziplist for a count smaller than the current ziplist length (which is a violation, inserting code expects the ziplist to get bigger actually). So an FF byte is inserted in a misplaced position. Moreover a realloc() is performed with a count smaller than the ziplist current length so the final bytes could be trashed as well. SECURITY IMPLICATIONS: Currently it looks like an attacker can only crash a Redis server by providing specifically choosen commands. However a FF byte is written and there are other memory operations that depend on a wrong count, so even if it is not immediately apparent how to mount an attack in order to execute code remotely, it is not impossible at all that this could be done. Attacks always get better... and we did not spent enough time in order to think how to exploit this issue, but security researchers or malicious attackers could.
-
- 06 Dec, 2016 1 commit
-
-
antirez authored
-
- 10 Jun, 2016 1 commit
-
-
Salvatore Sanfilippo authored
fix comment "b > a" to "a > b"
-
- 07 Jun, 2016 1 commit
-
-
andyli authored
-
- 08 May, 2016 1 commit
-
-
Adam Baldwin authored
-
- 05 May, 2016 11 commits
-
-
Jan-Erik Rediger authored
1 microsecond = 1000 nanoseconds 1e3 = 1000 10e3 = 10000
-
Oran Agra authored
-
antirez authored
This fixes issue #3043. Before this fix, after a complete resharding of a master slots to other nodes, the master remains empty and the slaves migrate away to other masters with non-zero nodes. However the old master now empty, is no longer considered a target for migration, because the system has no way to tell it had slaves in the past. This fix leaves the algorithm used in the past untouched, but adds a new rule. When a new or old master which is empty and without slaves, are assigend with their first slot, if other masters in the cluster have slaves, they are automatically considered to be targets for replicas migration.
-
antirez authored
-
antirez authored
-
David Cavar authored
Fix issue in case the redirect address is in ipv6 format. Parse from behind to extract last part of the response which represents actual port.
-
antirez authored
Thanks to @tushar2708 for the PR. I applied a slightly different fix. Thanks to @cespare for reporting. Close #3024 Close #3020
-
Salvatore Sanfilippo authored
Ensure slots are rechecked on EXEC.
-
Ryosuke Hasebe authored
-
Ryosuke Hasebe authored
-
- 11 Mar, 2016 1 commit
-
-
Chris Thunes authored
Fixes #2515.
-
- 10 Feb, 2016 2 commits
-
-
antirez authored
-
yoav@monfort.co.il authored
-
- 05 Feb, 2016 2 commits
-
-
antirez authored
-
Itamar Haber authored
-
- 31 Jan, 2016 3 commits
-
-
antirez authored
-
antirez authored
-
Salvatore Sanfilippo authored
Removes more spuriousness from 3.0.7
-
- 30 Jan, 2016 1 commit
-
-
Itamar Haber authored
-
- 29 Jan, 2016 4 commits
-
-
antirez authored
-
antirez authored
-
antirez authored
CLUSTER SLOTS now includes IDs in the nodes description associated with a given slot range. Certain client libraries implementations need a way to reference a node in an unique way, so they were relying on CLUSTER NODES, that is not a stable API and may change frequently depending on Redis Cluster future requirements.
-
antirez authored
Certain things were only applicable to 3.2.0 RC2 and RC3.
-
- 28 Jan, 2016 1 commit
-
-
antirez authored
We had to fix a few last minutes bugs.
-
- 26 Jan, 2016 6 commits
-
-
antirez authored
Reported here: https://www.reddit.com/r/redis/comments/42r0i0/avg_ttl_varies_a_lot/
-
antirez authored
-
antirez authored
-
antirez authored
-
antirez authored
The change covers the case where: 1. There is a node we can't reach (in fail or pfail state). 2. We see a different address for this node, in the gossip section sent to us by a node that, instead, is able to talk with the node we cannot talk to. In this case it's a good bet to switch to the address reported by this node, since there was an address switch and it is able to talk with the node and we are not. However previosuly this was done in a dangerous way, by initiating an handshake. The handshake, using the MEET packet, forces the receiver to join our cluster, and this is not a good idea. If the node in question really just switched address, but is the same node, it already knows about us, so we just need to perform an address update and a reconnection. So with this commit instead we just update the address of the node, release the node link if any, and attempt to reconnect in the next clusterCron() cycle. The commit also improves debugging messages printed by Cluster during address or ID switches.
-
antirez authored
-
- 25 Jan, 2016 4 commits
-
-
antirez authored
-
antirez authored
-
antirez authored
Centralize cleanup of newargv in a single place. Add more comments to help a bit following a complex function. Related to issue #3016.
-
antirez authored
Another leak was fixed in the case of syntax error by restructuring the allocation strategy for the two dynamic vectors. We also make sure to always close the cached socket on I/O errors so that all the I/O errors are handled the same, even if we had a previously queued error of a different kind from the destination server. Thanks to Kevin McGehee. Related to issue #3016.
-