1. 24 7月, 2017 5 次提交
  2. 11 7月, 2017 1 次提交
  3. 30 6月, 2017 2 次提交
    • A
      Fix abort typo in Lua debugger help screen. · 7018d27d
      antirez 提交于
      7018d27d
    • A
      Added GEORADIUS(BYMEMBER)_RO variants for read-only operations. · d557144e
      antirez 提交于
      Issue #4084 shows how for a design error, GEORADIUS is a write command
      because of the STORE option. Because of this it does not work
      on readonly slaves, gets redirected to masters in Redis Cluster even
      when the connection is in READONLY mode and so forth.
      
      To break backward compatibility at this stage, with Redis 4.0 to be in
      advanced RC state, is problematic for the user base. The API can be
      fixed into the unstable branch soon if we'll decide to do so in order to
      be more consistent, and reease Redis 5.0 with this incompatibility in
      the future. This is still unclear.
      
      However, the ability to scale GEO queries in slaves easily is too
      important so this commit adds two read-only variants to the GEORADIUS
      and GEORADIUSBYMEMBER command: GEORADIUS_RO and GEORADIUSBYMEMBER_RO.
      The commands are exactly as the original commands, but they do not
      accept the STORE and STOREDIST options.
      d557144e
  4. 28 6月, 2017 5 次提交
  5. 27 6月, 2017 1 次提交
  6. 22 6月, 2017 4 次提交
  7. 20 6月, 2017 4 次提交
  8. 15 6月, 2017 1 次提交
  9. 17 5月, 2017 1 次提交
  10. 15 5月, 2017 1 次提交
  11. 21 4月, 2017 4 次提交
  12. 20 4月, 2017 1 次提交
  13. 14 4月, 2017 1 次提交
  14. 09 4月, 2017 1 次提交
  15. 20 2月, 2017 2 次提交
  16. 12 2月, 2017 2 次提交
  17. 09 2月, 2017 1 次提交
    • A
      Fix MIGRATE closing of cached socket on error. · 33fad43c
      antirez 提交于
      After investigating issue #3796, it was discovered that MIGRATE
      could call migrateCloseSocket() after the original MIGRATE c->argv
      was already rewritten as a DEL operation. As a result the host/port
      passed to migrateCloseSocket() could be anything, often a NULL pointer
      that gets deferenced crashing the server.
      
      Now the socket is closed at an earlier time when there is a socket
      error in a later stage where no retry will be performed, before we
      rewrite the argument vector. Moreover a check was added so that later,
      in the socket_err label, there is no further attempt at closing the
      socket if the argument was rewritten.
      
      This fix should resolve the bug reported in #3796.
      33fad43c
  18. 31 1月, 2017 1 次提交
  19. 30 1月, 2017 2 次提交
    • A
      Ziplist: insertion bug under particular conditions fixed. · 3876d985
      antirez 提交于
      Ziplists had a bug that was discovered while investigating a different
      issue, resulting in a corrupted ziplist representation, and a likely
      segmentation foult and/or data corruption of the last element of the
      ziplist, once the ziplist is accessed again.
      
      The bug happens when a specific set of insertions / deletions is
      performed so that an entry is encoded to have a "prevlen" field (the
      length of the previous entry) of 5 bytes but with a count that could be
      encoded in a "prevlen" field of a since byte. This could happen when the
      "cascading update" process called by ziplistInsert()/ziplistDelete() in
      certain contitious forces the prevlen to be bigger than necessary in
      order to avoid too much data moving around.
      
      Once such an entry is generated, inserting a very small entry
      immediately before it will result in a resizing of the ziplist for a
      count smaller than the current ziplist length (which is a violation,
      inserting code expects the ziplist to get bigger actually). So an FF
      byte is inserted in a misplaced position. Moreover a realloc() is
      performed with a count smaller than the ziplist current length so the
      final bytes could be trashed as well.
      
      SECURITY IMPLICATIONS:
      
      Currently it looks like an attacker can only crash a Redis server by
      providing specifically choosen commands. However a FF byte is written
      and there are other memory operations that depend on a wrong count, so
      even if it is not immediately apparent how to mount an attack in order
      to execute code remotely, it is not impossible at all that this could be
      done. Attacks always get better... and we did not spent enough time in
      order to think how to exploit this issue, but security researchers
      or malicious attackers could.
      
      REPRODUCING:
      
      The bug can be reproduced with the following commands.
      
          redis-cli del list
          redis-cli rpush list one
          redis-cli rpush list two
          redis-cli rpush list
          AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
          redis-cli rpush list
          AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
          redis-cli rpush list three
          redis-cli rpush list a
          redis-cli lrem list 1
          AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
          redis-cli linsert list after
          AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
          10
          redis-cli lrange list 0 -1
      
      Instead of "rpush list a", use "rpush list 10" in order to trigger a
      data corruption instead of a crash.
      3876d985
    • A
      Jemalloc updated to 4.4.0. · 153f2f00
      antirez 提交于
      The original jemalloc source tree was modified to:
      
      1. Remove the configure error that prevents nested builds.
      2. Insert the Redis private Jemalloc API in order to allow the
      Redis fragmentation function to work.
      153f2f00