1. 10 Feb, 2017 1 commit
  2. 09 Feb, 2017 1 commit
    • antirez's avatar
      Fix MIGRATE closing of cached socket on error. · f917e0da
      antirez authored
      After investigating issue #3796, it was discovered that MIGRATE
      could call migrateCloseSocket() after the original MIGRATE c->argv
      was already rewritten as a DEL operation. As a result the host/port
      passed to migrateCloseSocket() could be anything, often a NULL pointer
      that gets deferenced crashing the server.
      
      Now the socket is closed at an earlier time when there is a socket
      error in a later stage where no retry will be performed, before we
      rewrite the argument vector. Moreover a check was added so that later,
      in the socket_err label, there is no further attempt at closing the
      socket if the argument was rewritten.
      
      This fix should resolve the bug reported in #3796.
      f917e0da
  3. 01 Feb, 2017 2 commits
    • antirez's avatar
      Fix ziplist fix... · 0dbfb1d1
      antirez authored
      0dbfb1d1
    • antirez's avatar
      Ziplist: insertion bug under particular conditions fixed. · c495d095
      antirez authored
      Ziplists had a bug that was discovered while investigating a different
      issue, resulting in a corrupted ziplist representation, and a likely
      segmentation foult and/or data corruption of the last element of the
      ziplist, once the ziplist is accessed again.
      
      The bug happens when a specific set of insertions / deletions is
      performed so that an entry is encoded to have a "prevlen" field (the
      length of the previous entry) of 5 bytes but with a count that could be
      encoded in a "prevlen" field of a since byte. This could happen when the
      "cascading update" process called by ziplistInsert()/ziplistDelete() in
      certain contitious forces the prevlen to be bigger than necessary in
      order to avoid too much data moving around.
      
      Once such an entry is generated, inserting a very small entry
      immediately before it will result in a resizing of the ziplist for a
      count smaller than the current ziplist length (which is a violation,
      inserting code expects the ziplist to get bigger actually). So an FF
      byte is inserted in a misplaced position. Moreover a realloc() is
      performed with a count smaller than the ziplist current length so the
      final bytes could be trashed as well.
      
      SECURITY IMPLICATIONS:
      
      Currently it looks like an attacker can only crash a Redis server by
      providing specifically choosen commands. However a FF byte is written
      and there are other memory operations that depend on a wrong count, so
      even if it is not immediately apparent how to mount an attack in order
      to execute code remotely, it is not impossible at all that this could be
      done. Attacks always get better... and we did not spent enough time in
      order to think how to exploit this issue, but security researchers
      or malicious attackers could.
      c495d095
  4. 30 Jan, 2017 1 commit
  5. 27 Jan, 2017 1 commit
  6. 26 Jan, 2017 1 commit
  7. 18 Jan, 2017 2 commits
    • antirez's avatar
      Add panic() into redisassert.h. · 17ac46ea
      antirez authored
      This header file is for libs, like ziplist.c, that we want to leave
      almost separted from the core. The panic() calls will be easy to delete
      in order to use such files outside, but the debugging info we gain are
      very valuable compared to simple assertions where it is not possible to
      print debugging info.
      17ac46ea
    • antirez's avatar
      serverPanic(): allow printf() alike formatting. · 53b8bf2c
      antirez authored
      This is of great interest because allows us to print debugging
      informations that could be of useful when debugging, like in the
      following example:
      
          serverPanic("Unexpected encoding for object %d, %d",
              obj->type, obj->encoding);
      53b8bf2c
  8. 13 Jan, 2017 1 commit
  9. 12 Jan, 2017 3 commits
  10. 11 Jan, 2017 3 commits
  11. 10 Jan, 2017 2 commits
  12. 08 Jan, 2017 1 commit
  13. 02 Jan, 2017 1 commit
  14. 30 Dec, 2016 1 commit
  15. 24 Dec, 2016 1 commit
    • oranagra's avatar
      fix rare assertion in DEBUG DIGEST · b2da5ea7
      oranagra authored
      getExpire calls dictFind which can do rehashing.
      found by calling computeDatasetDigest from serverCron and running the test suite.
      b2da5ea7
  16. 20 Dec, 2016 2 commits
    • antirez's avatar
      Geo: fix GEOHASH return value for consistency. · 0f722570
      antirez authored
      The same thing observed in #3551 by gnethercutt also fixed for
      GEOHASH as the original PR did.
      0f722570
    • antirez's avatar
      Geo: fix edge case return values for uniformity. · 913070a9
      antirez authored
      There were two cases outlined in issue #3512 and PR #3551 where
      the Geo API returned unexpected results: empty strings where NULL
      replies were expected, or a single null reply where an array was
      expected. This violates the Redis principle that Redis replies for
      existing keys or elements should be indistinguishable.
      
      This is technically an API breakage so will be merged only into 4.0 and
      specified in the changelog in the list of breaking compatibilities, even
      if it is not very likely that actual code will be affected, hopefully,
      since with the past behavior basically there was to acconut for *both*
      the possibilities, and the new behavior is always one of the two, but
      in a consistent way.
      913070a9
  17. 19 Dec, 2016 4 commits
  18. 16 Dec, 2016 6 commits
  19. 14 Dec, 2016 2 commits
  20. 13 Dec, 2016 4 commits
    • antirez's avatar
      Writable slaves expires: fix leak in key tracking. · b6f871cf
      antirez authored
      We need to use a dictionary type that frees the key, since we copy the
      keys in the dictionary we use to track expires created in the slave
      side.
      b6f871cf
    • antirez's avatar
      INFO: show num of slave-expires keys tracked. · d1adc85a
      antirez authored
      d1adc85a
    • antirez's avatar
      Fix created->created typo in expire.c · 5b9ba264
      antirez authored
      5b9ba264
    • antirez's avatar
      Replication: fix the infamous key leakage of writable slaves + EXPIRE. · 04542cff
      antirez authored
      BACKGROUND AND USE CASEj
      
      Redis slaves are normally write only, however the supprot a "writable"
      mode which is very handy when scaling reads on slaves, that actually
      need write operations in order to access data. For instance imagine
      having slaves replicating certain Sets keys from the master. When
      accessing the data on the slave, we want to peform intersections between
      such Sets values. However we don't want to intersect each time: to cache
      the intersection for some time often is a good idea.
      
      To do so, it is possible to setup a slave as a writable slave, and
      perform the intersection on the slave side, perhaps setting a TTL on the
      resulting key so that it will expire after some time.
      
      THE BUG
      
      Problem: in order to have a consistent replication, expiring of keys in
      Redis replication is up to the master, that synthesize DEL operations to
      send in the replication stream. However slaves logically expire keys
      by hiding them from read attempts from clients so that if the master did
      not promptly sent a DEL, the client still see logically expired keys
      as non existing.
      
      Because slaves don't actively expire keys by actually evicting them but
      just masking from the POV of read operations, if a key is created in a
      writable slave, and an expire is set, the key will be leaked forever:
      
      1. No DEL will be received from the master, which does not know about
      such a key at all.
      
      2. No eviction will be performed by the slave, since it needs to disable
      eviction because it's up to masters, otherwise consistency of data is
      lost.
      
      THE FIX
      
      In order to fix the problem, the slave should be able to tag keys that
      were created in the slave side and have an expire set in some way.
      
      My solution involved using an unique additional dictionary created by
      the writable slave only if needed. The dictionary is obviously keyed by
      the key name that we need to track: all the keys that are set with an
      expire directly by a client writing to the slave are tracked.
      
      The value in the dictionary is a bitmap of all the DBs where such a key
      name need to be tracked, so that we can use a single dictionary to track
      keys in all the DBs used by the slave (actually this limits the solution
      to the first 64 DBs, but the default with Redis is to use 16 DBs).
      
      This solution allows to pay both a small complexity and CPU penalty,
      which is zero when the feature is not used, actually. The slave-side
      eviction is encapsulated in code which is not coupled with the rest of
      the Redis core, if not for the hook to track the keys.
      
      TODO
      
      I'm doing the first smoke tests to see if the feature works as expected:
      so far so good. Unit tests should be added before merging into the
      4.0 branch.
      04542cff