Permalink
Browse files

Protections against protocol desyncs, leading to infinite query buffe…

…r growing, due to nul-terms in specific bytes of the request or indefinitely long multi bulk or bulk count strings without newlines. This bug is related to Issue #141 as well.
  • Loading branch information...
1 parent a5045d5 commit e7b85b331556609c127e02e895aaf1e99cff67a4 @antirez committed Dec 31, 2011
Showing with 24 additions and 6 deletions.
  1. +23 −6 src/networking.c
  2. +1 −0 src/redis.h
View
@@ -1,6 +1,8 @@
#include "redis.h"
#include <sys/uio.h>
+static void setProtocolError(redisClient *c, int pos);
+
void *dupClientReplyValue(void *o) {
incrRefCount((robj*)o);
return o;
@@ -678,8 +680,13 @@ int processInlineBuffer(redisClient *c) {
size_t querylen;
/* Nothing to do without a \r\n */
- if (newline == NULL)
+ if (newline == NULL) {
+ if (sdslen(c->querybuf) > REDIS_INLINE_MAX_SIZE) {
+ addReplyError(c,"Protocol error: too big inline request");
+ setProtocolError(c,0);
+ }
return REDIS_ERR;
+ }
/* Split the input buffer up to the \r\n */
querylen = newline-(c->querybuf);
@@ -729,8 +736,13 @@ int processMultibulkBuffer(redisClient *c) {
/* Multi bulk length cannot be read without a \r\n */
newline = strchr(c->querybuf,'\r');
- if (newline == NULL)
+ if (newline == NULL) {
+ if (sdslen(c->querybuf) > REDIS_INLINE_MAX_SIZE) {
+ addReplyError(c,"Protocol error: too big mbulk count string");
+ setProtocolError(c,0);
+ }
return REDIS_ERR;
+ }
/* Buffer should also contain \n */
if (newline-(c->querybuf) > ((signed)sdslen(c->querybuf)-2))
@@ -764,8 +776,13 @@ int processMultibulkBuffer(redisClient *c) {
/* Read bulk length if unknown */
if (c->bulklen == -1) {
newline = strchr(c->querybuf+pos,'\r');
- if (newline == NULL)
+ if (newline == NULL) {
+ if (sdslen(c->querybuf) > REDIS_INLINE_MAX_SIZE) {
+ addReplyError(c,"Protocol error: too big bulk count string");
+ setProtocolError(c,0);
+ }
break;
+ }
/* Buffer should also contain \n */
if (newline-(c->querybuf) > ((signed)sdslen(c->querybuf)-2))
@@ -806,9 +823,9 @@ int processMultibulkBuffer(redisClient *c) {
c->querybuf = sdsrange(c->querybuf,pos,-1);
/* We're done when c->multibulk == 0 */
- if (c->multibulklen == 0) {
- return REDIS_OK;
- }
+ if (c->multibulklen == 0) return REDIS_OK;
+
+ /* Still not read to process the command */
return REDIS_ERR;
}
View
@@ -49,6 +49,7 @@
#define REDIS_REQUEST_MAX_SIZE (1024*1024*256) /* max bytes in inline command */
#define REDIS_SHARED_INTEGERS 10000
#define REDIS_REPLY_CHUNK_BYTES (5*1500) /* 5 TCP packets with default MTU */
+#define REDIS_INLINE_MAX_SIZE (1024*64) /* Max size of inline reads */
#define REDIS_MAX_LOGMSG_LEN 4096 /* Default maximum length of syslog messages */
#define REDIS_AUTO_AOFREWRITE_PERC 100
#define REDIS_AUTO_AOFREWRITE_MIN_SIZE (1024*1024)

0 comments on commit e7b85b3

Please sign in to comment.