1. 14 Jun, 2018 2 commits
  2. 13 Jun, 2018 14 commits
    • antirez's avatar
      Redis 5.0 RC2. · f7209749
      antirez authored
      f7209749
    • antirez's avatar
      RDB: Apply fix to rdbLoadMillisecondTime() only for new RDB versions. · 5171a3ff
      antirez authored
      This way we let big endian systems to still load old RDB versions.
      However newver versions will be saved and loaded in a way that make RDB
      expires cross-endian again. Thanks to @oranagra for the reporting and
      the discussion about this problem, leading to this fix.
      5171a3ff
    • antirez's avatar
      Streams: generate a few additional events. · af706962
      antirez authored
      Currently it does not look it's sensible to generate events for streams
      consumer groups modification, being them metadata, however at least for
      key-level events, like the creation or removal of a consumer group, I
      added a few events here and there. Later we can evaluate if it makes
      sense to add more. From the POV instead of WAIT (in Redis transaciton)
      and signaling the key as modified, it looks like that the transaction
      should not fail when a stream is modified, so no calls are made in
      consumer groups related functions to signalModifiedKey().
      af706962
    • antirez's avatar
      Fix rdbSaveKeyValuePair() integer overflow. · 3ad68a07
      antirez authored
      Again thanks to @oranagra. The object idle time does not fit into an int
      sometimes: use the native type that the serialization function will get
      as argument, which is uint64_t.
      3ad68a07
    • antirez's avatar
      In scanDatabaseForReadyLists() now we need to handle ZSETs as well. · 68382091
      antirez authored
      Since the introduction of ZPOP makes this needed. Thanks to @oranagra
      for reporting.
      68382091
    • antirez's avatar
      RDB: store times consistently in little endian. · 6b0cdbd9
      antirez authored
      I'm not sure how this escaped the attention of Redis users for years,
      but finally @oranagra reported this issue... Thanks to Oran.
      6b0cdbd9
    • antirez's avatar
      Streams: improve type correctness in t_stream.c. · 574017b7
      antirez authored
      574017b7
    • antirez's avatar
      Fix XGROUP help missing space. · cd2b5a79
      antirez authored
      cd2b5a79
    • Baoyi Chen's avatar
      fix typo · 8246a38e
      Baoyi Chen authored
      fix [#5005](https://github.com/antirez/redis/issues/5005)
      8246a38e
    • antirez's avatar
      Security: fix redis-cli buffer overflow. · b80e4b69
      antirez authored
      Thanks to Fakhri Zulkifli for reporting it.
      
      The fix switched to dynamic allocation, copying the final prompt in the
      static buffer only at the end.
      b80e4b69
    • antirez's avatar
      Security: fix Lua struct package offset handling. · 5e0d9841
      antirez authored
      After the first fix to the struct package I found another similar
      problem, which is fixed by this patch. It could be reproduced easily by
      running the following script:
      
          return struct.unpack('f', "xxxxxxxxxxxxx",-3)
      
      The above will access bytes before the 'data' pointer.
      5e0d9841
    • antirez's avatar
      Security: more cmsgpack fixes by @soloestoy. · e27a0401
      antirez authored
      @soloestoy sent me this additional fixes, after searching for similar
      problems to the one reported in mp_pack(). I'm committing the changes
      because it was not possible during to make a public PR to protect Redis
      users and give Redis providers some time to patch their systems.
      e27a0401
    • antirez's avatar
      Security: update Lua struct package for security. · c5dfff46
      antirez authored
      During an auditing Apple found that the "struct" Lua package
      we ship with Redis (http://www.inf.puc-rio.br/~roberto/struct/) contains
      a security problem. A bound-checking statement fails because of integer
      overflow. The bug exists since we initially integrated this package with
      Lua, when scripting was introduced, so every version of Redis with
      EVAL/EVALSHA capabilities exposed is affected.
      
      Instead of just fixing the bug, the library was updated to the latest
      version shipped by the author.
      c5dfff46
    • antirez's avatar
      Security: fix Lua cmsgpack library stack overflow. · 86aade74
      antirez authored
      During an auditing effort, the Apple Vulnerability Research team discovered
      a critical Redis security issue affecting the Lua scripting part of Redis.
      
      -- Description of the problem
      
      Several years ago I merged a pull request including many small changes at
      the Lua MsgPack library (that originally I authored myself). The Pull
      Request entered Redis in commit 90b6337c, in 2014.
      Unfortunately one of the changes included a variadic Lua function that
      lacked the check for the available Lua C stack. As a result, calling the
      "pack" MsgPack library function with a large number of arguments, results
      into pushing into the Lua C stack a number of new values proportional to
      the number of arguments the function was called with. The pushed values,
      moreover, are controlled by untrusted user input.
      
      This in turn causes stack smashing which we believe to be exploitable,
      while not very deterministic, but it is likely that an exploit could be
      created targeting specific versions of Redis executables. However at its
      minimum the issue results in a DoS, crashing the Redis server.
      
      -- Versions affected
      
      Versions greater or equal to Redis 2.8.18 are affected.
      
      -- Reproducing
      
      Reproduce with this (based on the original reproduction script by
      Apple security team):
      
      https://gist.github.com/antirez/82445fcbea6d9b19f97014cc6cc79f8a
      
      -- Verification of the fix
      
      The fix was tested in the following way:
      
      1) I checked that the problem is no longer observable running the trigger.
      2) The Lua code was analyzed to understand the stack semantics, and that
      actually enough stack is allocated in all the cases of mp_pack() calls.
      3) The mp_pack() function was modified in order to show exactly what items
      in the stack were being set, to make sure that there is no silent overflow
      even after the fix.
      
      -- Credits
      
      Thank you to the Apple team and to the other persons that helped me
      checking the patch and coordinating this communication.
      86aade74
  3. 12 Jun, 2018 24 commits