Commit Graph

212 Commits

Author SHA1 Message Date
michael-grunder
560e664862 Minor refactor
Protect against a NULL pointer dereference, and remove unused write
to a variable.
2022-09-08 11:18:43 -07:00
Michael Grunder
79ae5ffc69
Fix protocol error (#1106)
Fix ProtocolError

This commit attempts to fix hiredis such that a recoverable write error
will be retried rather than throwing a hard error.

Since our read/write functions are now behind function pointers, we
specify semantically that a return value of < 0 is a hard error, 0 a
recoverable error, and > 0 a success.

Our default `redisNetRead` function was already doing something similar
so this also improves code consistency.

Resolves #961

Co-authored-by: Maksim Tuleika <maksim.tuleika@appcast.io>
2022-09-05 11:59:21 -07:00
zhenwei pi
fce8abc1c1 Introduce .close method for redisContextFuncs
Currently, hiredis supports TCP/SSL/Unix, all of the connection types
use a single FD(int), close() is enough to close a connection. For the
further step, introduce .close method for redisContextFuncs, this
allows to close a complex connection context, for example RDMA.

Signed-off-by: zhenwei pi <pizhenwei@bytedance.com>
2022-09-02 10:25:52 -07:00
zhangtaoXT5
bc8d837b72
fix heap-buffer-overflow (#957)
Prevent incrementing passed a `\0` in our format string.

Co-authored-by: Michael Grunder <michael.grunder@gmail.com>
Co-authored-by: Kristján Valur Jónsson <sweskman@gmail.com>
2022-09-01 13:45:28 -07:00
Viktor Söderqvist
10c78c6e17 Add possibility to prefer IPv6, IPv4 or unspecified 2022-09-01 10:42:36 -07:00
Björn Svensson
329eaf9bae Fix heap-buffer-overflow issue in redisvFormatCommad
A command with a faulty formatting string that lacks the
conversion specifier results in a ASAN heap-buffer-overflow.
This was due to that strchr() matches on null-termination,
which triggers a continuation of the string parsing.
2022-09-01 10:35:07 -07:00
Michael Grunder
77e4f09ea8
Merge pull request #964 from afcidk/fix-createDoubleObject
Fix potential fault at createDoubleObject
2022-08-29 12:24:57 -07:00
sundb
f2be748024
Fix integer overflow when format command larger than 4GB (#1030) 2021-12-22 10:45:52 -08:00
Pei-Hsuan Hung
50cdcab49d Fix potential fault at createDoubleObject
Resolves #963.

Add additional check to `hi_malloc` for `r->str` when len equals to
SIZE_MAX.
2021-11-01 12:17:05 +08:00
michael-grunder
e489846b72 Minor refactor of CVE-2021-32765 fix.
Since `hi_calloc` always passes through one of our wrapper functions,
we can perform this overflow in the wrapper, and get protection
everywhere.

Previous commit: 76a7b10005

Related vuln ID: CVE-2021-32765
[Full Details](https://github.com/redis/hiredis/security/advisories/GHSA-hfm9-39pp-55p2)
2021-10-10 11:13:23 -07:00
michael-grunder
a39824a5df Merge branch 'release/v1.0.1'
Merge the v1.0.1 release branch and bump the dev version to 1.0.2-dev
2021-10-04 13:35:10 -07:00
Yossi Gottlieb
76a7b10005 Fix for integer/buffer overflow CVE-2021-32765
This fix prevents hiredis from trying to allocate more than `SIZE_MAX`
bytes, which would result in a buffer overrun.

[Full Details](https://github.com/redis/hiredis/security/advisories/GHSA-hfm9-39pp-55p2)
2021-10-04 11:56:31 -07:00
rouzier
2d9d77518d
Don't leak memory if an invalid type is set (#906)
Co-authored-by: James Rouzier <jrouzier@inverse.ca>
2021-08-18 19:13:34 -07:00
Meir Shpilraien (Spielrein)
f5f31ff9b9
Added REDIS_NO_AUTO_FREE_REPLIES flag (#962)
When set hiredis will not automatically free replies in an async context, and the replies must be freed instead by the user.

Co-authored-by: Michael Grunder <michael.grunder@gmail.com>
2021-07-11 11:26:20 -07:00
michael-grunder
dfa33e60b0 Change order independant push logic to not change behavior.
Since redisGetReplyFromReader is exposed in a header file, we probably
shouldn't modify how it behaves in any way.  For this reason, handle the
changed logic in an internal static helper method.
2021-04-02 09:34:09 -07:00
michael-grunder
6204182aae Handle the case where an invalidation is sent second.
RESP3 invalidation messages always seemed to be sent before the response
to a given command, but it appears this is not always the case:

In Redis 6.2.0RC1 Redis sends the invalidation after the HSET in the
following sequence:

```
hget hash field
$5
value
hset hash field value
:0
>2
$10
invalidate
*1
$4
hash
```

To account for this possibility just wrap redisGetReplyFromReader in a
loop as it is called twice in redisGetReply.
2021-04-02 09:34:09 -07:00
Alex Smith
83c1450425 read: Add support for the RESP3 bignum type 2021-02-25 21:25:17 -08:00
Alex Smith
c8adea4024 redisReply: Fix parent type assertions during double, nil, bool creation
Per RESP3, push messages are able to contain exactly what array
messages can contain (that is, any other type).
2021-02-25 21:25:17 -08:00
Alex Smith
ff73f1f9e7 redisReply: Explicitly list nil and bool cases in freeReplyObject() switch. 2021-02-25 21:25:17 -08:00
Alex Smith
49539fd1a7 redisReply: Fix - set len in double objects 2021-02-25 21:25:17 -08:00
michael-grunder
b9b9f446fe Fix handling of NIL invalidation messages.
When CLIENT TRACKING is enabled, Redis will send an invalidation message
with a NIL payload to all tracking clients after a FLUSHDB is executed.

We didn't account for REDIS_REPLY_PUSH being a valid parent object to a
NIL payload, and were failing an assertion.

Additionally this commit adds a regression test for the logic.
2020-10-17 19:08:05 -07:00
Guy Korland
b086f763e7
clean a warning, remvoe empty else block 2020-10-12 17:15:29 +03:00
Michael Grunder
d8ff72387d
Move SSL management to a distinct private pointer. (#855)
We need to allow our users to use redisContext->privdata as context
for any RESP3 PUSH messages, which means we can't use it for managing
SSL connections.

Bulletpoints:

* Create a secondary redisContext member for internal use only called
  privctx and rename the redisContextFuncs->free_privdata accordingly.

* Adds a `free_privdata` function pointer so the user can tie allocated
  memory to the lifetime of a redisContext (like they can already do
  with redisAsyncContext)

* Enables SSL tests in .travis.yml
2020-07-29 11:53:03 -07:00
valentinogeron
38b5ae543f
add a command_timeout to redisContextOptions (#839)
Add an additional timeout so the user has a convenient way of controlling distinct connect and command timeouts
2020-07-26 12:32:27 -07:00
Michael Grunder
2e7d7cbabd
Resp3 oob push support (#841)
Proper support for RESP3 PUSH messages.

By default, PUSH messages are now intercepted and the reply memory freed.  
This means existing code should work unchanged when connecting to Redis
>= 6.0.0 even if `CLIENT TRACKING` were then enabled.

Additionally, we define two callbacks users can configure if they wish to handle
these messages in a custom way:

void redisPushFn(void *privdata, void *reply);
void redisAsyncPushFn(redisAsyncContext *ac, void *reply);

See #825
2020-07-19 18:54:42 -07:00
valentinogeron
a28de70a01
timeout option in redisConnectWithOptions should be on connect only (#829)
When connecting with a timeout, we shouldn't also call `redisSetTimeout` which will implement a timeout for commands.

See related issue #722
2020-06-18 21:45:25 -07:00
Michael Grunder
6448f735d5
sdsrange overflow fix (#830)
Fix overflow bug in `sdsrange`
2020-06-07 14:38:16 -07:00
Michael Grunder
8e0264cfd6
Allow users to replace allocator and handle OOM everywhere. (#800)
* Adds an indirection to every allocation/deallocation to allow users to 
  plug in ones of their choosing (use custom functions, jemalloc, etc).

* Gracefully handle OOM everywhere in hiredis.  This should make it possible
  for users of the library to have more flexibility in how they handle such situations.

* Changes `redisReaderTask->elements` from an `int` to a `long long` to prevent
  a possible overflow when transferring the task elements into a `redisReply`.

* Adds a configurable `max elements` member to `redisReader` that defaults to
  2^32 - 1.  This can be set to "unlimited" by setting the value to zero.
2020-05-22 09:27:49 -07:00
Michael Grunder
83bba659b9
Add logic to handle RESP3 push messages (#819)
Fixes #815
2020-05-21 11:12:18 -07:00
Michael Grunder
5c9f49e212
Resp3 verbatim string support (#805)
Pull RESP3 verbatim string handling from Redis

Fixes #802
2020-05-19 12:56:02 -07:00
michael-grunder
ac0b186aa3 Free the reply in redisGetReply when passed NULL
We currently perform a NULL check in redisGetReply and don't push the
reply back to the caller, but we don't free any reply meaning that this
will leak memory:

redisGetReply(context, NULL);

This change simply frees the reply if we were passed NULL.

Addresses #740
2019-12-12 14:40:50 -08:00
Yossi Gottlieb
d41443bd3d Fix: redisReconnect() should clear SSL context.
We should not attempt to keep the context and re-establish the
TLS connection for several reasons:

1. Maintain symmetry between redisConnect() and redisReconnect(), so in
both cases an extra step is required to initiate SSL.
2. The caller may also wish to reconfigure the SSL session and needs a
chance to do that.
3. It is not a practical thing to do on an async non-blocking connection
context.
2019-09-16 17:30:35 +03:00
Yossi Gottlieb
8715ba5c82 wip: SSL code reorganization, see #705. 2019-08-29 22:09:37 +03:00
Mark Nunberg
ff4fa45422
Merge pull request #697 from yossigo/resp3
Port RESP3 support from Redis.
2019-08-27 06:59:32 -04:00
Mark Nunberg
f9bccfb7ba
Merge branch 'master' into createArray-size_t 2019-08-09 04:02:53 -04:00
Yossi Gottlieb
91de9c975a RESP3 support changes from Redis.
This corresponds to commits d5c54f0b..bea09a7f in the redis repository.
2019-08-04 12:13:04 +03:00
Mark Nunberg
4830786c84 ensure that blocking timeout is set 2019-04-10 08:36:06 -04:00
m
dc6d19b9ec Port network layer to Winsock
With this change, Hiredis builds with MinGW and runs on Windows.
2019-04-01 11:54:37 +02:00
m
e84086cb92 Introduce a redisFD type
The redisFD type should be equal to the system native socket file
desciptor type (for POSIX, this is a plain int).

We also introduce the REDIS_INVALID_FD value, which maps to -1 on POSIX
systems.
2019-04-01 11:52:24 +02:00
m
1788f41f16 Move network I/O calls to net.c
This makes hiredis.c free from system calls related to socket I/O. This
is also makes the treatment of raw socket connections more similar to
the SSL backend.
2019-04-01 11:52:24 +02:00
Mark Nunberg
5eb6958870 Allow option for async connections to not automatically free 2019-02-21 11:49:25 -05:00
Mark Nunberg
ea9f9d2515 fixed wrong memset args 2019-02-20 09:11:10 -05:00
Mark Nunberg
1eb44cf0c4 scrub redisContext before freeing
This helps us detect use-after-free
2019-02-20 09:11:10 -05:00
valentino
847a20122f Fix memory leaks 2019-02-20 09:10:10 -05:00
valentino
58222c26f4 Support SNI 2019-02-20 09:10:10 -05:00
Mark Nunberg
f4f6b6d65c minor fixes: initialize options struct with 0 always
also, clean up redisContextInit -- we're just zeoring the struct
2019-02-20 09:10:10 -05:00
Mark Nunberg
e4a78006e7 Provide option-struct initialization
This reduces the boilerplate of all the redisConnectXXX functions, and
allows us to provide more connection options in the future.
2019-02-20 09:10:10 -05:00
Mark Nunberg
0c14544906 Initial SSL (sync) implementation 2019-02-20 09:10:10 -05:00
Stefan Hacker
169fcc708b Fix redisBufferRead documentation
Referred to redisContextReadReply which I cannot find in this codebase
nor the old redis-tools one. Presumably this meant to say
redisGetReplyFromReader which is how redisBufferRead is used in this
file. Could've also meant the interface function redisReaderGetReply.
2018-10-24 23:56:51 +02:00
Mark Nunberg
49974c9359 Call connect(2) again for non-blocking connect
This retrieves the actual error which occurred, as getsockopt is not
always reliable in this regard.
2018-09-25 20:21:37 -04:00