1. 04 Oct, 2021 1 commit
    • Oran Agra's avatar
      Prevent unauthenticated client from easily consuming lots of memory (CVE-2021-32675) · 71be9729
      Oran Agra authored
      This change sets a low limit for multibulk and bulk length in the
      protocol for unauthenticated connections, so that they can't easily
      cause redis to allocate massive amounts of memory by sending just a few
      characters on the network.
      The new limits are 10 arguments of 16kb each (instead of 1m of 512mb)
      
      (cherry picked from commit 3d221e81f3b680543e34942579af190b049ff283)
      71be9729
  2. 21 Jul, 2021 1 commit
    • Huang Zhw's avatar
      On 32 bit platform, the bit position of GETBIT/SETBIT/BITFIELD/BITCOUNT,BITPOS... · 449af2cd
      Huang Zhw authored
      On 32 bit platform, the bit position of GETBIT/SETBIT/BITFIELD/BITCOUNT,BITPOS may overflow (see CVE-2021-32761) (#9191)
      
      GETBIT, SETBIT may access wrong address because of wrap.
      BITCOUNT and BITPOS may return wrapped results.
      BITFIELD may access the wrong address but also allocate insufficient memory and segfault (see CVE-2021-32761).
      
      This commit uses `uint64_t` or `long long` instead of `size_t`.
      related https://github.com/redis/redis/pull/8096
      
      At 32bit platform:
      > setbit bit 4294967295 1
      (integer) 0
      > config set proto-max-bulk-len 536870913
      OK
      > append bit "\xFF"
      (integer) 536870913
      > getbit bit 4294967296
      (integer) 0
      
      When the bit index is larger than 4294967295, size_t can't hold bit index. In the past,  `proto-max-bulk-len` is limit to 536870912, so there is no problem.
      
      After this commit, bit position is stored in `uint64_t` or `long long`. So when `proto-max-bulk-len > 536870912`, 32bit platforms can still be correct.
      
      For 64bit platform, this problem still exists. The major reason is bit pos 8 times of byte pos. When proto-max-bulk-len is very larger, bit pos may overflow.
      But at 64bit platform, we don't have so long string. So this bug may never happen.
      
      Additionally this commit add a test cost `512MB` memory which is tag as `large-memory`. Make freebsd ci and valgrind ci ignore this test.
      * This test is disabled in this version since bitops doesn't rely on
      proto-max-bulk-len. some of the overflows can still occur so we do want
      the fixes.
      
      (cherry picked from commit 71d45287)
      (cherry picked from commit 2be8f1de1d452886fbf45030409707c52323da20)
      449af2cd
  3. 27 Oct, 2020 1 commit
    • Oran Agra's avatar
      RESTORE ABSTTL won't store expired keys into the db (#7472) · e9c9e4c2
      Oran Agra authored
      Similarly to EXPIREAT with TTL in the past, which implicitly deletes the
      key and return success, RESTORE should not store key that are already
      expired into the db.
      When used together with REPLACE it should emit a DEL to keyspace
      notification and replication stream.
      
      (cherry picked from commit 5977a948)
      (cherry picked from commit 95ba01b5)
      e9c9e4c2
  4. 05 Mar, 2020 2 commits
    • Guy Benoish's avatar
      Blocking XREAD[GROUP] should always reply with valid data (or timeout) · 7f3fcedb
      Guy Benoish authored
      This commit solves the following bug:
      127.0.0.1:6379> XGROUP CREATE x grp $ MKSTREAM
      OK
      127.0.0.1:6379> XADD x 666 f v
      "666-0"
      127.0.0.1:6379> XREADGROUP GROUP grp Alice BLOCK 0 STREAMS x >
      1) 1) "x"
         2) 1) 1) "666-0"
               2) 1) "f"
                  2) "v"
      127.0.0.1:6379> XADD x 667 f v
      "667-0"
      127.0.0.1:6379> XDEL x 667
      (integer) 1
      127.0.0.1:6379> XREADGROUP GROUP grp Alice BLOCK 0 STREAMS x >
      1) 1) "x"
         2) (empty array)
      
      The root cause is that we use s->last_id in streamCompareID
      while we should use the last *valid* ID
      7f3fcedb
    • Guy Benoish's avatar
      Stream: Handle streamID-related edge cases · 89682d96
      Guy Benoish authored
      This commit solves several edge cases that are related to
      exhausting the streamID limits: We should correctly calculate
      the succeeding streamID instead of blindly incrementing 'seq'
      This affects both XREAD and XADD.
      
      Other (unrelated) changes:
      Reply with a better error message when trying to add an entry
      to a stream that has exhausted last_id
      89682d96
  5. 19 Nov, 2019 4 commits
  6. 05 Sep, 2019 1 commit
  7. 14 May, 2019 1 commit
    • antirez's avatar
      Test: fix slowlog test false positive. · 7ac7ffd5
      antirez authored
      In fast systems "SLOWLOG RESET" is fast enough to don't be logged even
      when the time limit is "1" sometimes. Leading to false positives such
      as:
      
      [err]: SLOWLOG - can be disabled in tests/unit/slowlog.tcl
      Expected '1' to be equal to '0'
      7ac7ffd5
  8. 13 May, 2019 3 commits
  9. 18 Mar, 2019 2 commits
  10. 13 Mar, 2019 2 commits
  11. 11 Dec, 2018 3 commits
  12. 20 Nov, 2018 2 commits
  13. 17 Oct, 2018 5 commits
  14. 15 Oct, 2018 3 commits
  15. 09 Oct, 2018 1 commit
  16. 03 Oct, 2018 1 commit
  17. 14 Sep, 2018 1 commit
  18. 05 Sep, 2018 1 commit
  19. 29 Aug, 2018 2 commits
    • Oran Agra's avatar
      Fix unstable tests on slow machines. · af675f0a
      Oran Agra authored
      Few tests had borderline thresholds that were adjusted.
      
      The slave buffers test had two issues, preventing the slave buffer from growing:
      1) the slave didn't necessarily go to sleep on time, or woke up too early,
         now using SIGSTOP to make sure it goes to sleep exactly when we want.
      2) the master disconnected the slave on timeout
      af675f0a
    • zhaozhao.zz's avatar
      1203a04f
  20. 02 Aug, 2018 1 commit
    • antirez's avatar
      Test: new sorted set skiplist order consistency. · 70c4bcb7
      antirez authored
      This should be able to find new bugs and regressions about the new
      sorted set update function when ZADD is used to update an element
      already existing.
      
      The test is able to find the bug fixed at 2f282aee immediately.
      70c4bcb7
  21. 24 Jul, 2018 1 commit
    • Oran Agra's avatar
      fix slave buffer test suite false positives · 4b79fdf1
      Oran Agra authored
      it looks like on slow machines we're getting:
      [err]: slave buffer are counted correctly in tests/unit/maxmemory.tcl
      Expected condition '$slave_buf > 2*1024*1024' to be true (16914 > 2*1024*1024)
      
      this is a result of the slave waking up too early and eating the
      slave buffer before the traffic and the test ends.
      4b79fdf1
  22. 18 Jul, 2018 1 commit
    • Oran Agra's avatar
      make active defrag test more stable · f89c93c8
      Oran Agra authored
      on slower machines, the active defrag test tended to fail.
      although the fragmentation ratio was below the treshold, the defragger was
      still in the middle of a scan cycle.
      
      this commit changes:
      - the defragger uses the current fragmentation state, rather than the cache one
        that is updated by server cron every 100ms. this actually fixes a bug of
        starting one excess scan cycle
      - the test lets the defragger use more CPU cycles, in hope that the defrag
        will be faster, but also give it more time before we give up.
      f89c93c8