1. 02 Oct, 2016 4 commits
  2. 26 Sep, 2016 3 commits
    • antirez's avatar
      6782e774
    • antirez's avatar
    • antirez's avatar
      Security: CONFIG SET client-output-buffer-limit overflow fixed. · 6d9f8e24
      antirez authored
      This commit fixes a vunlerability reported by Cory Duplantis
      of Cisco Talos, see TALOS-2016-0206 for reference.
      
      CONFIG SET client-output-buffer-limit accepts as client class "master"
      which is actually only used to implement CLIENT KILL. The "master" class
      has ID 3. What happens is that the global structure:
      
          server.client_obuf_limits[class]
      
      Is accessed with class = 3. However it is a 3 elements array, so writing
      the 4th element means to write up to 24 bytes of memory *after* the end
      of the array, since the structure is defined as:
      
          typedef struct clientBufferLimitsConfig {
              unsigned long long hard_limit_bytes;
              unsigned long long soft_limit_bytes;
              time_t soft_limit_seconds;
          } clientBufferLimitsConfig;
      
      EVALUATION OF IMPACT:
      
      Checking what's past the boundaries of the array in the global
      'server' structure, we find AOF state fields:
      
          clientBufferLimitsConfig client_obuf_limits[CLIENT_TYPE_OBUF_COUNT];
        ...
      6d9f8e24
  3. 21 Sep, 2016 2 commits
  4. 20 Sep, 2016 1 commit
    • antirez's avatar
      dict.c: fix dictGenericDelete() return ASAP condition. · 67058671
      antirez authored
      Recently we moved the "return ASAP" condition for the Delete() function
      from checking .size to checking .used, which is smarter, however while
      testing the first table alone always works to ensure the dict is totally
      emtpy, when we test the .size field, testing .used requires testing both
      T0 and T1, since a rehashing could be in progress.
      67058671
  5. 19 Sep, 2016 5 commits
  6. 16 Sep, 2016 7 commits
  7. 15 Sep, 2016 6 commits
  8. 14 Sep, 2016 4 commits
    • antirez's avatar
      dict.c: dictReplaceRaw() -> dictAddOrFind(). · 09a50d34
      antirez authored
      What they say about "naming things" in programming?
      09a50d34
    • antirez's avatar
      Trim comment to 80 cols. · 041ab044
      antirez authored
      041ab044
    • antirez's avatar
      Apply the new dictUnlink() where possible. · a636aeac
      antirez authored
      Optimizations suggested and originally implemented by @oranagra.
      Re-applied by @antirez using the modified API.
      a636aeac
    • oranagra's avatar
      dict.c: introduce dictUnlink(). · afcbcc0e
      oranagra authored
      Notes by @antirez:
      
      This patch was picked from a larger commit by Oran and adapted to change
      the API a bit. The basic idea is to avoid double lookups when there is
      to use the value of the deleted entry.
      
      BEFORE:
      
          entry = dictFind( ... ); /* 1st lookup. */
          /* Do somethjing with the entry. */
          dictDelete(...);         /* 2nd lookup. */
      
      AFTER:
      
          entry = dictUnlink( ... ); /* 1st lookup. */
          /* Do somethjing with the entry. */
          dictFreeUnlinkedEntry(entry); /* No lookups!. */
      afcbcc0e
  9. 13 Sep, 2016 2 commits
    • antirez's avatar
      MEMORY OVERHEAD implemented (using Oran Agra initial implementation). · 8c84c962
      antirez authored
      This code was extracted from @oranagra PR #3223 and modified in order
      to provide only certain amounts of information compared to the original
      code. It was also moved from DEBUG to the newly introduced MEMORY
      command. Thanks to Oran for the implementation and the PR.
      
      It implements detailed memory usage stats that can be useful in both
      provisioning and troubleshooting memory usage in Redis.
      8c84c962
    • antirez's avatar
      objectComputeSize(): estimate collections sampling N elements. · 89dec692
      antirez authored
      For most tasks, we need the memory estimation to be O(1) by default.
      This commit also implements an initial MEMORY command.
      Note that objectComputeSize() takes the number of samples to check as
      argument, so MEMORY should be able to get the sample size as option
      to make precision VS CPU tradeoff tunable.
      
      Related to: PR #3223.
      89dec692
  10. 12 Sep, 2016 2 commits
  11. 09 Sep, 2016 4 commits