1. 01 Feb, 2017 1 commit
    • antirez's avatar
      Ziplist: insertion bug under particular conditions fixed. · 48e24d54
      antirez authored
      Ziplists had a bug that was discovered while investigating a different
      issue, resulting in a corrupted ziplist representation, and a likely
      segmentation foult and/or data corruption of the last element of the
      ziplist, once the ziplist is accessed again.
      
      The bug happens when a specific set of insertions / deletions is
      performed so that an entry is encoded to have a "prevlen" field (the
      length of the previous entry) of 5 bytes but with a count that could be
      encoded in a "prevlen" field of a since byte. This could happen when the
      "cascading update" process called by ziplistInsert()/ziplistDelete() in
      certain contitious forces the prevlen to be bigger than necessary in
      order to avoid too much data moving around.
      
      Once such an entry is generated, inserting a very small entry
      immediately before it will result in a resizing of the ziplist for a
      count smaller than the current ziplist length (which is a violation,
      inserting code expects the ziplist to get bigger actually). So an FF
      byte is inserted in a misplaced position. Moreover a realloc() is
      performed with a count smaller than the ziplist current length so the
      final bytes could be trashed as well.
      
      SECURITY IMPLICATIONS:
      
      Currently it looks like an attacker can only crash a Redis server by
      providing specifically choosen commands. However a FF byte is written
      and there are other memory operations that depend on a wrong count, so
      even if it is not immediately apparent how to mount an attack in order
      to execute code remotely, it is not impossible at all that this could be
      done. Attacks always get better... and we did not spent enough time in
      order to think how to exploit this issue, but security researchers
      or malicious attackers could.
      48e24d54
  2. 06 Dec, 2016 1 commit
  3. 10 Jun, 2016 1 commit
  4. 07 Jun, 2016 1 commit
  5. 08 May, 2016 1 commit
  6. 05 May, 2016 11 commits
  7. 11 Mar, 2016 1 commit
  8. 10 Feb, 2016 2 commits
  9. 05 Feb, 2016 2 commits
  10. 31 Jan, 2016 3 commits
  11. 30 Jan, 2016 1 commit
  12. 29 Jan, 2016 4 commits
  13. 28 Jan, 2016 1 commit
  14. 26 Jan, 2016 6 commits
  15. 25 Jan, 2016 4 commits
    • antirez's avatar
      Fix merge issues with 3.2 backports. · 72f53260
      antirez authored
      72f53260
    • antirez's avatar
      Redis 3.0.7. · 53c9c299
      antirez authored
      53c9c299
    • antirez's avatar
      Minor MIGRATE refactoring. · d4090b16
      antirez authored
      Centralize cleanup of newargv in a single place.
      Add more comments to help a bit following a complex function.
      
      Related to issue #3016.
      d4090b16
    • antirez's avatar
      More variadic MIGRATE fixes. · 29c89df4
      antirez authored
      Another leak was fixed in the case of syntax error by restructuring the
      allocation strategy for the two dynamic vectors.
      
      We also make sure to always close the cached socket on I/O errors so that
      all the I/O errors are handled the same, even if we had a previously
      queued error of a different kind from the destination server.
      
      Thanks to Kevin McGehee. Related to issue #3016.
      29c89df4