1. 18 Jun, 2018 2 commits
    • antirez's avatar
      Streams: fix xreadGetKeys() buffer overflow. · a0b27dae
      antirez authored
      The loop allocated a buffer for the right number of keys positions, then
      overflowed it going past the limit.
      
      Related to #4857 and cause of the memory violation seen in #5028.
      a0b27dae
    • antirez's avatar
      Streams: Change XADD MAXLEN handling of values <= 0. · 62f9ac6f
      antirez authored
      Now a MAXLEN of 0 really does what it means: it will create a zero
      entries stream. This is useful in order to make sure that the behavior
      is identical to XTRIM, that must be able to reduce the stream to zero
      elements when MAXLEN is given.
      
      Also now MAXLEN with a count < 0 will return an error.
      62f9ac6f
  2. 17 Jun, 2018 1 commit
  3. 16 Jun, 2018 2 commits
  4. 14 Jun, 2018 7 commits
  5. 13 Jun, 2018 7 commits
    • zhaozhao.zz's avatar
      fix exists command on slave · 2ffa533f
      zhaozhao.zz authored
      2ffa533f
    • zhaozhao.zz's avatar
      optimize reply list memory usage · 963002d7
      zhaozhao.zz authored
      963002d7
    • antirez's avatar
      Security: fix redis-cli buffer overflow. · ce17f76b
      antirez authored
      Thanks to Fakhri Zulkifli for reporting it.
      
      The fix switched to dynamic allocation, copying the final prompt in the
      static buffer only at the end.
      ce17f76b
    • antirez's avatar
      Security: fix Lua struct package offset handling. · e89086e0
      antirez authored
      After the first fix to the struct package I found another similar
      problem, which is fixed by this patch. It could be reproduced easily by
      running the following script:
      
          return struct.unpack('f', "xxxxxxxxxxxxx",-3)
      
      The above will access bytes before the 'data' pointer.
      e89086e0
    • antirez's avatar
      Security: more cmsgpack fixes by @soloestoy. · 5ccb6f7a
      antirez authored
      @soloestoy sent me this additional fixes, after searching for similar
      problems to the one reported in mp_pack(). I'm committing the changes
      because it was not possible during to make a public PR to protect Redis
      users and give Redis providers some time to patch their systems.
      5ccb6f7a
    • antirez's avatar
      Security: update Lua struct package for security. · 1eb08bcd
      antirez authored
      During an auditing Apple found that the "struct" Lua package
      we ship with Redis (http://www.inf.puc-rio.br/~roberto/struct/) contains
      a security problem. A bound-checking statement fails because of integer
      overflow. The bug exists since we initially integrated this package with
      Lua, when scripting was introduced, so every version of Redis with
      EVAL/EVALSHA capabilities exposed is affected.
      
      Instead of just fixing the bug, the library was updated to the latest
      version shipped by the author.
      1eb08bcd
    • antirez's avatar
      Security: fix Lua cmsgpack library stack overflow. · 52a00201
      antirez authored
      During an auditing effort, the Apple Vulnerability Research team discovered
      a critical Redis security issue affecting the Lua scripting part of Redis.
      
      -- Description of the problem
      
      Several years ago I merged a pull request including many small changes at
      the Lua MsgPack library (that originally I authored myself). The Pull
      Request entered Redis in commit 90b6337c, in 2014.
      Unfortunately one of the changes included a variadic Lua function that
      lacked the check for the available Lua C stack. As a result, calling the
      "pack" MsgPack library function with a large number of arguments, results
      into pushing into the Lua C stack a number of new values proportional to
      the number of arguments the function was called with. The pushed values,
      moreover, are controlled by untrusted user input.
      
      This in turn causes stack smashing which we believe to be exploitable,
      while not very deterministic, but it is likely that an exploit could be
      created targeting specific versions of Redis executables. However at its
      minimum the issue results in a DoS, crashing the Redis server.
      
      -- Versions affected
      
      Versions greater or equal to Redis 2.8.18 are affected.
      
      -- Reproducing
      
      Reproduce with this (based on the original reproduction script by
      Apple security team):
      
      https://gist.github.com/antirez/82445fcbea6d9b19f97014cc6cc79f8a
      
      -- Verification of the fix
      
      The fix was tested in the following way:
      
      1) I checked that the problem is no longer observable running the trigger.
      2) The Lua code was analyzed to understand the stack semantics, and that
      actually enough stack is allocated in all the cases of mp_pack() calls.
      3) The mp_pack() function was modified in order to show exactly what items
      in the stack were being set, to make sure that there is no silent overflow
      even after the fix.
      
      -- Credits
      
      Thank you to the Apple team and to the other persons that helped me
      checking the patch and coordinating this communication.
      52a00201
  6. 12 Jun, 2018 16 commits
  7. 11 Jun, 2018 5 commits
    • antirez's avatar
      Use a less aggressive query buffer resize policy. · cec404f0
      antirez authored
      A user with many connections (10 thousand) on a single Redis server
      reports in issue #4983 that sometimes Redis is idle becuase at the same
      time many clients need to resize their query buffer according to the old
      policy.
      
      It looks like this was created by the fact that we allow the query
      buffer to grow without problems to a size up to PROTO_MBULK_BIG_ARG
      normally, but when the client is idle we immediately are more strict,
      and a query buffer greater than 1024 bytes is already enough to trigger
      the resize. So for instance if most of the clients stop at the same time
      this issue should be easily triggered.
      
      This behavior actually looks odd, and there should be only a clear limit
      after we say, let's look at this query buffer to check if it's time to
      resize it. This commit puts the limit at PROTO_MBULK_BIG_ARG, and the
      check is performed both if compared to the peak usage the current usage
      is too big, or if the client is idle.
      
      Then when the check is performed, to waste just a few kbytes is
      considered enough to proceed with the resize. This should fix the issue.
      cec404f0
    • antirez's avatar
    • antirez's avatar
      Fix client unblocking for XREADGROUP, issue #4978. · 34bd4418
      antirez authored
      We unblocked the client too early, when the group name object was no
      longer valid in client->bpop, so propagating XCLAIM later in
      streamPropagateXCLAIM() deferenced a field already set to NULL.
      34bd4418
    • Salvatore Sanfilippo's avatar
      Merge pull request #5000 from shenlongxing/fix-config · ba210173
      Salvatore Sanfilippo authored
      fix integer case error
      ba210173
    • Salvatore Sanfilippo's avatar
      Merge pull request #4995 from shenlongxing/unstable · b136502d
      Salvatore Sanfilippo authored
      fix stream config typo
      b136502d