1. 31 Oct, 2017 1 commit
    • antirez's avatar
      Fix buffer overflows occurring reading redis.conf. · ffcf7d5a
      antirez authored
      There was not enough sanity checking in the code loading the slots of
      Redis Cluster from the nodes.conf file, this resulted into the
      attacker's ability to write data at random addresses in the process
      memory, by manipulating the index of the array. The bug seems
      exploitable using the following techique: the config file may be altered so
      that one of the nodes gets, as node ID (which is the first field inside the
      structure) some data that is actually executable: then by writing this
      address in selected places, this node ID part can be executed after a
      jump. So it is mostly just a matter of effort in order to exploit the
      bug. In practice however the issue is not very critical because the
      bug requires an unprivileged user to be able to modify the Redis cluster
      nodes configuration, and at the same time this should result in some
      gain. However Redis normally is unprivileged as well. Yet much better to
      have this fixed indeed.
      
      Fix #4278.
      ffcf7d5a
  2. 30 Oct, 2017 2 commits
    • antirez's avatar
      Regression test for issue #4391. · b2e29597
      antirez authored
      b2e29597
    • antirez's avatar
      More robust object -> double conversion. · de474186
      antirez authored
      Certain checks were useless, at the same time certain malformed inputs
      were accepted without problems (emtpy strings parsed as zero).
      Cases where strtod() returns ERANGE but we still want to parse the input
      where ok in getDoubleFromObject() but not in the long variant.
      
      As a side effect of these fixes, this commit fixes #4391.
      de474186
  3. 28 Sep, 2017 2 commits
  4. 27 Sep, 2017 3 commits
  5. 21 Sep, 2017 3 commits
  6. 20 Sep, 2017 2 commits
    • antirez's avatar
      PSYNC2: More refinements related to #4316. · bb3b5ddd
      antirez authored
      bb3b5ddd
    • zhaozhao.zz's avatar
      PSYNC2: make persisiting replication info more solid · b541ccef
      zhaozhao.zz authored
      This commit is a reinforcement of commit c1c99e9f.
      
      1. Replication information can be stored when the RDB file is
      generated by a mater using server.slaveseldb when server.repl_backlog
      is not NULL, or set repl_stream_db be -1. That's safe, because
      NULL server.repl_backlog will trigger full synchronization,
      then master will send SELECT command to replicaiton stream.
      2. Only do rdbSave* when rsiptr is not NULL,
      if we do rdbSave* without rdbSaveInfo, slave will miss repl-stream-db.
      3. Save the replication informations also in the case of
      SAVE command, FLUSHALL command and DEBUG reload.
      b541ccef
  7. 19 Sep, 2017 3 commits
    • antirez's avatar
      PSYNC2: Fix the way replication info is saved/loaded from RDB. · c1c99e9f
      antirez authored
      This commit attempts to fix a number of bugs reported in #4316.
      They are related to the way replication info like replication ID,
      offsets, and currently selected DB in the master client, are stored
      and loaded by Redis. In order to avoid inconsistencies the changes in
      this commit try to enforce that:
      
      1. Replication information are only stored when the RDB file is
      generated by a slave that has a valid 'master' client, so that we can
      always extract the currently selected DB.
      2. When replication informations are persisted in the RDB file, all the
      info for a successful PSYNC or nothing is persisted.
      3. The RDB replication informations are only loaded if the instance is
      configured as a slave, otherwise a master can start with IDs that relate
      to a different history of the data set, and stil retain such IDs in the
      future while receiving unrelated writes.
      c1c99e9f
    • antirez's avatar
    • antirez's avatar
      PSYNC2: Create backlog on slave partial sync as well. · b75ae0bb
      antirez authored
      A slave may be started with an RDB file able to provide enough slave to
      perform a successful partial SYNC with its master. However in such a
      case, how outlined in issue #4268, the slave backlog will not be
      started, since it was only initialized on full syncs attempts. This
      creates different problems with successive PSYNC attempts that will
      always result in full synchronizations.
      
      Thanks to @fdingiit for discovering the issue.
      b75ae0bb
  8. 18 Sep, 2017 3 commits
  9. 17 Sep, 2017 1 commit
    • Oran Agra's avatar
      Flush append only buffers before existing. · b122cadc
      Oran Agra authored
      when SHUTDOWN command is recived it is possible that some of the recent
      command were not yet flushed from the AOF buffer, and the server
      experiences data loss at shutdown.
      b122cadc
  10. 03 Aug, 2017 2 commits
  11. 02 Aug, 2017 1 commit
  12. 28 Jul, 2017 1 commit
  13. 25 Jul, 2017 1 commit
  14. 24 Jul, 2017 8 commits
  15. 23 Jul, 2017 2 commits
    • antirez's avatar
      Modules: don't crash when Lua calls a module blocking command. · 31404355
      antirez authored
      Lua scripting does not support calling blocking commands, however all
      the native Redis commands are flagged as "s" (no scripting flag), so
      this is not possible at all. With modules there is no such mechanism in
      order to flag a command as non callable by the Lua scripting engine,
      moreover we cannot trust the modules users from complying all the times:
      it is likely that modules will be released to have blocking commands
      without such commands being flagged correctly, even if we provide a way to
      signal this fact.
      
      This commit attempts to address the problem in a short term way, by
      detecting that a module is trying to block in the context of the Lua
      scripting engine client, and preventing to do this. The module will
      actually believe to block as usually, but what happens is that the Lua
      script receives an error immediately, and the background call is ignored
      by the Redis engine (if not for the cleanup callbacks, once it
      unblocks).
      
      Long term, the more likely solution, is to introduce a new call called
      RedisModule_GetClientFlags(), so that a command can detect if the caller
      is a Lua script, and return an error, or avoid blocking at all.
      
      Being the blocking API experimental right now, more work is needed in
      this regard in order to reach a level well blocking module commands and
      all the other Redis subsystems interact peacefully.
      
      Now the effect is like the following:
      
          127.0.0.1:6379> eval "redis.call('hello.block',1,5000)" 0
          (error) ERR Error running script (call to
          f_b5ba35ff97bc1ef23debc4d6e9fd802da187ed53): @user_script:1: ERR
          Blocking module command called from Lua script
      
      This commit fixes issue #4127 in the short term.
      31404355
    • antirez's avatar
      5bfdfbe1
  16. 20 Jul, 2017 3 commits
    • antirez's avatar
      Make representClusterNodeFlags() more robust. · a3778f3b
      antirez authored
      This function failed when an internal-only flag was set as an only flag
      in a node: the string was trimmed expecting a final comma before
      exiting the function, causing a crash. See issue #4142.
      Moreover generation of flags representation only needed at DEBUG log
      level was always performed: a waste of CPU time. This is fixed as well
      by this commit.
      a3778f3b
    • antirez's avatar
      Fix two bugs in moduleTypeLookupModuleByID(). · b1c2e1a1
      antirez authored
      The function cache was not working at all, and the function returned
      wrong values if there where two or more modules exporting native data
      types.
      
      See issue #4131 for more details.
      b1c2e1a1
    • Leon Chen's avatar
      fix return wrong value of clusterDelNodeSlots · 9e7a8c02
      Leon Chen authored
      9e7a8c02
  17. 18 Jul, 2017 1 commit
  18. 15 Jul, 2017 1 commit