1. 10 Jul, 2023 1 commit
  2. 17 Jan, 2023 1 commit
    • Meir Shpilraien (Spielrein)'s avatar
      Clean Lua stack before parsing call reply to avoid crash on a call with many arguments (#9809) · a511af7c
      Meir Shpilraien (Spielrein) authored
      This commit 0f8b634c (CVE-2021-32626 released in 6.2.6, 6.0.16, 5.0.14)
      fixes an invalid memory write issue by using `lua_checkstack` API to make
      sure the Lua stack is not overflow. This fix was added on 3 places:
      1. `luaReplyToRedisReply`
      2. `ldbRedis`
      3. `redisProtocolToLuaType`
      
      On the first 2 functions, `lua_checkstack` is handled gracefully while the
      last is handled with an assert and a statement that this situation can
      not happened (only with misbehave module):
      
      > the Redis reply might be deep enough to explode the LUA stack (notice
      that currently there is no such command in Redis that returns such a nested
      reply, but modules might do it)
      
      The issue that was discovered is that user arguments is also considered part
      of the stack, and so the following script (for example) make the assertion reachable:
      ```
      local a = {}
      for i=1,7999 do
          a[i] = 1
      end
      return redis.call("lpush", "l", unpack(a))
      ```
      
      This is a regression because such a script would have worked before and now
      its crashing Redis. The solution is to clear the function arguments from the Lua
      stack which makes the original assumption true and the assertion unreachable.
      
      (cherry picked from commit 6b0b04f1)
      a511af7c
  3. 04 Oct, 2021 1 commit
    • meir@redislabs.com's avatar
      Fix protocol parsing on 'ldbReplParseCommand' (CVE-2021-32672) · 6ac3c0b7
      meir@redislabs.com authored
      The protocol parsing on 'ldbReplParseCommand' (LUA debugging)
      Assumed protocol correctness. This means that if the following
      is given:
      *1
      $100
      test
      The parser will try to read additional 94 unallocated bytes after
      the client buffer.
      This commit fixes this issue by validating that there are actually enough
      bytes to read. It also limits the amount of data that can be sent by
      the debugger client to 1M so the client will not be able to explode
      the memory.
      6ac3c0b7
  4. 12 Jan, 2021 1 commit
    • Oran Agra's avatar
      Fix wrong order of key/value in Lua map response (#8266) · ec56906b
      Oran Agra authored
      When a Lua script returns a map to redis (a feature which was added in
      redis 6 together with RESP3), it would have returned the value first and
      the key second.
      
      If the client was using RESP2, it was getting them out of order, and if
      the client was in RESP3, it was getting a map of value => key.
      This was happening regardless of the Lua script using redis.setresp(3)
      or not.
      
      This also affects a case where the script was returning a map which it got
      from from redis by doing something like: redis.setresp(3); return redis.call()
      
      This fix is a breaking change for redis 6.0 users who happened to rely
      on the wrong order (either ones that used redis.setresp(3), or ones that
      returned a map explicitly).
      
      This commit also includes other two changes in the tests:
      1. The test suite now handles RESP3 maps as dicts rather than nested
         lists
      2. Remove some redundant (duplicate) tests from tracking.tcl
      
      (cherry picked from commit 2017407b)
      ec56906b
  5. 27 Oct, 2020 2 commits
    • Oran Agra's avatar
      Fix crash in script timeout during AOF loading (#7870) · c80f6219
      Oran Agra authored
      
      (cherry picked from commit dc803d25)
      c80f6219
    • Oran Agra's avatar
      Squash merging 125 typo/grammar/comment/doc PRs (#7773) · 2ae7f491
      Oran Agra authored
      List of squashed commits or PRs
      ===============================
      
      commit 66801ea
      Author: hwware <wen.hui.ware@gmail.com>
      Date:   Mon Jan 13 00:54:31 2020 -0500
      
          typo fix in acl.c
      
      commit 46f55db
      Author: Itamar Haber <itamar@redislabs.com>
      Date:   Sun Sep 6 18:24:11 2020 +0300
      
          Updates a couple of comments
      
          Specifically:
      
          * RM_AutoMemory completed instead of pointing to docs
          * Updated link to custom type doc
      
      commit 61a2aa0
      Author: xindoo <xindoo@qq.com>
      Date:   Tue Sep 1 19:24:59 2020 +0800
      
          Correct errors in code comments
      
      commit a5871d1
      Author: yz1509 <pro-756@qq.com>
      Date:   Tue Sep 1 18:36:06 2020 +0800
      
          fix typos in module.c
      
      commit 41eede7
      Author: bookug <bookug@qq.com>
      Date:   Sat Aug 15 01:11:33 2020 +0800
      
          docs: fix typos in comments
      
      commit c303c84
      Author: lazy-snail <ws.niu@outlook.com>
      Date:   Fri Aug 7 11:15:44 2020 +0800
      
          fix spelling in redis.conf
      
      commit 1eb76bf
      Author: zhujian <zhujianxyz@gmail.com>...
      2ae7f491
  6. 07 Apr, 2020 1 commit
  7. 04 Feb, 2020 1 commit
  8. 20 Nov, 2019 1 commit
  9. 11 Sep, 2018 1 commit
  10. 05 Sep, 2018 1 commit
  11. 03 Jul, 2018 1 commit
  12. 25 Mar, 2018 1 commit
  13. 31 May, 2016 1 commit
  14. 06 May, 2016 1 commit
  15. 25 Apr, 2016 1 commit
  16. 08 Jan, 2016 1 commit
    • antirez's avatar
      Scripting: handle trailing comments. · f43c794b
      antirez authored
      This fix, provided by Paul Kulchenko (@pkulchenko), allows the Lua
      scripting engine to evaluate statements with a trailing comment like the
      following one:
      
          EVAL "print() --comment" 0
      
      Lua can't parse the above if the string does not end with a newline, so
      now a final newline is always added automatically. This does not change
      the SHA1 of scripts since the SHA1 is computed on the body we pass to
      EVAL, without the other code we add to register the function.
      
      Close #2951.
      f43c794b
  17. 30 Oct, 2015 3 commits
  18. 14 Dec, 2014 1 commit
    • Alon Diamant's avatar
      Added <count> parameter to SPOP: · 28802887
      Alon Diamant authored
      spopCommand() now runs spopWithCountCommand() in case the <count> param is found.
      Added intsetRandomMembers() to Intset: Copies N random members from the set into inputted 'values' array. Uses either the Knuth or Floyd sample algos depending on ratio count/size.
      Added setTypeRandomElements() to SET type: Returns a number of random elements from a non empty set. This is a version of setTypeRandomElement() that is modified in order to return multiple entries, using dictGetRandomKeys() and intsetRandomMembers().
      Added tests for SPOP with <count>: unit/type/set, unit/scripting, integration/aof
      --
      Cleaned up code a bit to match with required Redis coding style
      28802887
  19. 14 Nov, 2014 2 commits
    • Matt Stancliff's avatar
      Lua: add cmsgpack scripting tests · ace628c7
      Matt Stancliff authored
      Basically: test to make sure we can load cmsgpack
      and do some sanity checks to make sure pack/unpack works
      properly.  We also have a bonus test for circular encoding
      and decoding because I was curious how it worked.
      ace628c7
    • Matt Stancliff's avatar
      Lua: add cjson scripting test · e327c8ed
      Matt Stancliff authored
      Two simple decode tests added mainly to check that
      the 'cjson' global gets registered and is usable.
      e327c8ed
  20. 09 Oct, 2014 1 commit
    • Matt Stancliff's avatar
      Lua: Add bitop · 3fecb961
      Matt Stancliff authored
      A few people have written custom C commands because bit
      manipulation isn't exposed through Lua.  Let's give
      them Mike Pall's bitop.
      
      This adds bitop 1.0.2 (2012-05-08) from http://bitop.luajit.org/
      
      bitop is imported as "bit" into the global namespace.
      
      New Lua commands: bit.tobit, bit.tohex, bit.bnot, bit.band, bit.bor, bit.bxor,
      bit.lshift, bit.rshift, bit.arshift, bit.rol, bit.ror, bit.bswap
      
      Verification of working (the asserts would abort on error, so (nil) is correct):
      127.0.0.1:6379> eval "assert(bit.tobit(1) == 1); assert(bit.band(1) == 1); assert(bit.bxor(1,2) == 3); assert(bit.bor(1,2,4,8,16,32,64,128) == 255)" 0
      (nil)
      127.0.0.1:6379> eval 'assert(0x7fffffff == 2147483647, "broken hex literals"); assert(0xffffffff == -1 or 0xffffffff == 2^32-1, "broken hex literals"); assert(tostring(-1) == "-1", "broken tostring()"); assert(tostring(0xffffffff) == "-1" or tostring(0xffffffff) == "4294967295", "broken tostring()")' 0
      (nil)
      
      Tests also integrated into the scripting tests and can be run with:
      ./runtest --single unit/scripting
      
      Tests are excerpted from `bittest.lua` included in the bitop distribution.
      3fecb961
  21. 01 Sep, 2014 1 commit
  22. 07 Aug, 2014 1 commit
  23. 12 Jun, 2014 2 commits
    • antirez's avatar
      Scripting: regression test for issue #1811. · aa19fd61
      antirez authored
      aa19fd61
    • antirez's avatar
      Fix semantics of Lua calls to SELECT. · 96e0fe62
      antirez authored
      Lua scripts are executed in the context of the currently selected
      database (as selected by the caller of the script).
      
      However Lua scripts are also free to use the SELECT command in order to
      affect other DBs. When SELECT is called frm Lua, the old behavior, before
      this commit, was to automatically set the Lua caller selected DB to the
      last DB selected by Lua. See for example the following sequence of
      commands:
      
          SELECT 0
          SET x 10
          EVAL "redis.call('select','1')" 0
          SET x 20
      
      Before this commit after the execution of this sequence of commands,
      we'll have x=10 in DB 0, and x=20 in DB 1.
      
      Because of the problem above, there was a bug affecting replication of
      Lua scripts, because of the actual implementation of replication. It was
      possible to fix the implementation of Lua scripts in order to fix the
      issue, but looking closely, the bug is the consequence of the behavior
      of Lua ability to set the caller's DB.
      
      Under the old semantics, a script selecting a different DB, has no simple
      ways to restore the state and select back the previously selected DB.
      Moreover the script auhtor must remember that the restore is needed,
      otherwise the new commands executed by the caller, will be executed in
      the context of a different DB.
      
      So this commit fixes both the replication issue, and this hard-to-use
      semantics, by removing the ability of Lua, after the script execution,
      to force the caller to switch to the DB selected by the Lua script.
      
      The new behavior of the previous sequence of commadns is to just set
      X=20 in DB 0. However Lua scripts are still capable of writing / reading
      from different DBs if needed.
      
      WARNING: This is a semantical change that will break programs that are
      conceived to select the client selected DB via Lua scripts.
      
      This fixes issue #1811.
      96e0fe62
  24. 10 Jun, 2014 1 commit
    • Matt Stancliff's avatar
      Scripting: Fix regression from #1118 · 76efe122
      Matt Stancliff authored
      The new check-for-number behavior of Lua arguments broke
      users who use large strings of just integers.
      
      The Lua number check would convert the string to a number, but
      that breaks user data because
      Lua numbers have limited precision compared to an arbitrarily
      precise number wrapped in a string.
      
      Regression fixed and new test added.
      
      Fixes #1118 again.
      76efe122
  25. 04 Jun, 2014 1 commit
  26. 20 May, 2014 1 commit
  27. 07 May, 2014 1 commit
    • antirez's avatar
      Scripting test: check that Lua can call commands rewirting argv. · 76c31d42
      antirez authored
      SPOP, tested in the new test, is among the commands rewritng the
      client->argv argument vector (it gets rewritten as SREM) for command
      replication purposes.
      
      Because of recent optimizations to client->argv caching in the context
      of the Lua internal Redis client, it is important to test for SPOP to be
      callable from Lua without bad effects to the other commands.
      76c31d42
  28. 24 Apr, 2014 1 commit
  29. 06 Apr, 2014 1 commit
  30. 13 Feb, 2014 1 commit
  31. 30 Aug, 2013 1 commit
  32. 19 Jun, 2013 1 commit
  33. 19 Jan, 2013 1 commit
  34. 10 Jan, 2013 1 commit
  35. 22 Nov, 2012 1 commit
    • antirez's avatar
      EVALSHA is now case insensitive. · 95f68f7b
      antirez authored
      EVALSHA used to crash if the SHA1 was not lowercase (Issue #783).
      Fixed using a case insensitive dictionary type for the sha -> script
      map used for replication of scripts.
      95f68f7b