Commit Graph

210 Commits (fce8abc1c19ab731f5c84797aa71b4d49921913f)

Author SHA1 Message Date
zhenwei pi fce8abc1c1 Introduce .close method for redisContextFuncs
Currently, hiredis supports TCP/SSL/Unix, all of the connection types
use a single FD(int), close() is enough to close a connection. For the
further step, introduce .close method for redisContextFuncs, this
allows to close a complex connection context, for example RDMA.

Signed-off-by: zhenwei pi <pizhenwei@bytedance.com>
2022-09-02 10:25:52 -07:00
zhangtaoXT5 bc8d837b72
fix heap-buffer-overflow (#957)
Prevent incrementing passed a `\0` in our format string.

Co-authored-by: Michael Grunder <michael.grunder@gmail.com>
Co-authored-by: Kristján Valur Jónsson <sweskman@gmail.com>
2022-09-01 13:45:28 -07:00
Viktor Söderqvist 10c78c6e17 Add possibility to prefer IPv6, IPv4 or unspecified 2022-09-01 10:42:36 -07:00
Björn Svensson 329eaf9bae Fix heap-buffer-overflow issue in redisvFormatCommad
A command with a faulty formatting string that lacks the
conversion specifier results in a ASAN heap-buffer-overflow.
This was due to that strchr() matches on null-termination,
which triggers a continuation of the string parsing.
2022-09-01 10:35:07 -07:00
Michael Grunder 77e4f09ea8
Merge pull request #964 from afcidk/fix-createDoubleObject
Fix potential fault at createDoubleObject
2022-08-29 12:24:57 -07:00
sundb f2be748024
Fix integer overflow when format command larger than 4GB (#1030) 2021-12-22 10:45:52 -08:00
Pei-Hsuan Hung 50cdcab49d Fix potential fault at createDoubleObject
Resolves #963.

Add additional check to `hi_malloc` for `r->str` when len equals to
SIZE_MAX.
2021-11-01 12:17:05 +08:00
michael-grunder e489846b72 Minor refactor of CVE-2021-32765 fix.
Since `hi_calloc` always passes through one of our wrapper functions,
we can perform this overflow in the wrapper, and get protection
everywhere.

Previous commit: 76a7b10005

Related vuln ID: CVE-2021-32765
[Full Details](https://github.com/redis/hiredis/security/advisories/GHSA-hfm9-39pp-55p2)
2021-10-10 11:13:23 -07:00
michael-grunder a39824a5df Merge branch 'release/v1.0.1'
Merge the v1.0.1 release branch and bump the dev version to 1.0.2-dev
2021-10-04 13:35:10 -07:00
Yossi Gottlieb 76a7b10005 Fix for integer/buffer overflow CVE-2021-32765
This fix prevents hiredis from trying to allocate more than `SIZE_MAX`
bytes, which would result in a buffer overrun.

[Full Details](https://github.com/redis/hiredis/security/advisories/GHSA-hfm9-39pp-55p2)
2021-10-04 11:56:31 -07:00
rouzier 2d9d77518d
Don't leak memory if an invalid type is set (#906)
Co-authored-by: James Rouzier <jrouzier@inverse.ca>
2021-08-18 19:13:34 -07:00
Meir Shpilraien (Spielrein) f5f31ff9b9
Added REDIS_NO_AUTO_FREE_REPLIES flag (#962)
When set hiredis will not automatically free replies in an async context, and the replies must be freed instead by the user.

Co-authored-by: Michael Grunder <michael.grunder@gmail.com>
2021-07-11 11:26:20 -07:00
michael-grunder dfa33e60b0 Change order independant push logic to not change behavior.
Since redisGetReplyFromReader is exposed in a header file, we probably
shouldn't modify how it behaves in any way.  For this reason, handle the
changed logic in an internal static helper method.
2021-04-02 09:34:09 -07:00
michael-grunder 6204182aae Handle the case where an invalidation is sent second.
RESP3 invalidation messages always seemed to be sent before the response
to a given command, but it appears this is not always the case:

In Redis 6.2.0RC1 Redis sends the invalidation after the HSET in the
following sequence:

```
hget hash field
$5
value
hset hash field value
:0
>2
$10
invalidate
*1
$4
hash
```

To account for this possibility just wrap redisGetReplyFromReader in a
loop as it is called twice in redisGetReply.
2021-04-02 09:34:09 -07:00
Alex Smith 83c1450425 read: Add support for the RESP3 bignum type 2021-02-25 21:25:17 -08:00
Alex Smith c8adea4024 redisReply: Fix parent type assertions during double, nil, bool creation
Per RESP3, push messages are able to contain exactly what array
messages can contain (that is, any other type).
2021-02-25 21:25:17 -08:00
Alex Smith ff73f1f9e7 redisReply: Explicitly list nil and bool cases in freeReplyObject() switch. 2021-02-25 21:25:17 -08:00
Alex Smith 49539fd1a7 redisReply: Fix - set len in double objects 2021-02-25 21:25:17 -08:00
michael-grunder b9b9f446fe Fix handling of NIL invalidation messages.
When CLIENT TRACKING is enabled, Redis will send an invalidation message
with a NIL payload to all tracking clients after a FLUSHDB is executed.

We didn't account for REDIS_REPLY_PUSH being a valid parent object to a
NIL payload, and were failing an assertion.

Additionally this commit adds a regression test for the logic.
2020-10-17 19:08:05 -07:00
Guy Korland b086f763e7
clean a warning, remvoe empty else block 2020-10-12 17:15:29 +03:00
Michael Grunder d8ff72387d
Move SSL management to a distinct private pointer. (#855)
We need to allow our users to use redisContext->privdata as context
for any RESP3 PUSH messages, which means we can't use it for managing
SSL connections.

Bulletpoints:

* Create a secondary redisContext member for internal use only called
  privctx and rename the redisContextFuncs->free_privdata accordingly.

* Adds a `free_privdata` function pointer so the user can tie allocated
  memory to the lifetime of a redisContext (like they can already do
  with redisAsyncContext)

* Enables SSL tests in .travis.yml
2020-07-29 11:53:03 -07:00
valentinogeron 38b5ae543f
add a command_timeout to redisContextOptions (#839)
Add an additional timeout so the user has a convenient way of controlling distinct connect and command timeouts
2020-07-26 12:32:27 -07:00
Michael Grunder 2e7d7cbabd
Resp3 oob push support (#841)
Proper support for RESP3 PUSH messages.

By default, PUSH messages are now intercepted and the reply memory freed.  
This means existing code should work unchanged when connecting to Redis
>= 6.0.0 even if `CLIENT TRACKING` were then enabled.

Additionally, we define two callbacks users can configure if they wish to handle
these messages in a custom way:

void redisPushFn(void *privdata, void *reply);
void redisAsyncPushFn(redisAsyncContext *ac, void *reply);

See #825
2020-07-19 18:54:42 -07:00
valentinogeron a28de70a01
timeout option in redisConnectWithOptions should be on connect only (#829)
When connecting with a timeout, we shouldn't also call `redisSetTimeout` which will implement a timeout for commands.

See related issue #722
2020-06-18 21:45:25 -07:00
Michael Grunder 6448f735d5
sdsrange overflow fix (#830)
Fix overflow bug in `sdsrange`
2020-06-07 14:38:16 -07:00
Michael Grunder 8e0264cfd6
Allow users to replace allocator and handle OOM everywhere. (#800)
* Adds an indirection to every allocation/deallocation to allow users to 
  plug in ones of their choosing (use custom functions, jemalloc, etc).

* Gracefully handle OOM everywhere in hiredis.  This should make it possible
  for users of the library to have more flexibility in how they handle such situations.

* Changes `redisReaderTask->elements` from an `int` to a `long long` to prevent
  a possible overflow when transferring the task elements into a `redisReply`.

* Adds a configurable `max elements` member to `redisReader` that defaults to
  2^32 - 1.  This can be set to "unlimited" by setting the value to zero.
2020-05-22 09:27:49 -07:00
Michael Grunder 83bba659b9
Add logic to handle RESP3 push messages (#819)
Fixes #815
2020-05-21 11:12:18 -07:00
Michael Grunder 5c9f49e212
Resp3 verbatim string support (#805)
Pull RESP3 verbatim string handling from Redis

Fixes #802
2020-05-19 12:56:02 -07:00
michael-grunder ac0b186aa3 Free the reply in redisGetReply when passed NULL
We currently perform a NULL check in redisGetReply and don't push the
reply back to the caller, but we don't free any reply meaning that this
will leak memory:

redisGetReply(context, NULL);

This change simply frees the reply if we were passed NULL.

Addresses #740
2019-12-12 14:40:50 -08:00
Yossi Gottlieb d41443bd3d Fix: redisReconnect() should clear SSL context.
We should not attempt to keep the context and re-establish the
TLS connection for several reasons:

1. Maintain symmetry between redisConnect() and redisReconnect(), so in
both cases an extra step is required to initiate SSL.
2. The caller may also wish to reconfigure the SSL session and needs a
chance to do that.
3. It is not a practical thing to do on an async non-blocking connection
context.
2019-09-16 17:30:35 +03:00
Yossi Gottlieb 8715ba5c82 wip: SSL code reorganization, see #705. 2019-08-29 22:09:37 +03:00
Mark Nunberg ff4fa45422
Merge pull request #697 from yossigo/resp3
Port RESP3 support from Redis.
2019-08-27 06:59:32 -04:00
Mark Nunberg f9bccfb7ba
Merge branch 'master' into createArray-size_t 2019-08-09 04:02:53 -04:00
Yossi Gottlieb 91de9c975a RESP3 support changes from Redis.
This corresponds to commits d5c54f0b..bea09a7f in the redis repository.
2019-08-04 12:13:04 +03:00
Mark Nunberg 4830786c84 ensure that blocking timeout is set 2019-04-10 08:36:06 -04:00
m dc6d19b9ec Port network layer to Winsock
With this change, Hiredis builds with MinGW and runs on Windows.
2019-04-01 11:54:37 +02:00
m e84086cb92 Introduce a redisFD type
The redisFD type should be equal to the system native socket file
desciptor type (for POSIX, this is a plain int).

We also introduce the REDIS_INVALID_FD value, which maps to -1 on POSIX
systems.
2019-04-01 11:52:24 +02:00
m 1788f41f16 Move network I/O calls to net.c
This makes hiredis.c free from system calls related to socket I/O. This
is also makes the treatment of raw socket connections more similar to
the SSL backend.
2019-04-01 11:52:24 +02:00
Mark Nunberg 5eb6958870 Allow option for async connections to not automatically free 2019-02-21 11:49:25 -05:00
Mark Nunberg ea9f9d2515 fixed wrong memset args 2019-02-20 09:11:10 -05:00
Mark Nunberg 1eb44cf0c4 scrub redisContext before freeing
This helps us detect use-after-free
2019-02-20 09:11:10 -05:00
valentino 847a20122f Fix memory leaks 2019-02-20 09:10:10 -05:00
valentino 58222c26f4 Support SNI 2019-02-20 09:10:10 -05:00
Mark Nunberg f4f6b6d65c minor fixes: initialize options struct with 0 always
also, clean up redisContextInit -- we're just zeoring the struct
2019-02-20 09:10:10 -05:00
Mark Nunberg e4a78006e7 Provide option-struct initialization
This reduces the boilerplate of all the redisConnectXXX functions, and
allows us to provide more connection options in the future.
2019-02-20 09:10:10 -05:00
Mark Nunberg 0c14544906 Initial SSL (sync) implementation 2019-02-20 09:10:10 -05:00
Stefan Hacker 169fcc708b Fix redisBufferRead documentation
Referred to redisContextReadReply which I cannot find in this codebase
nor the old redis-tools one. Presumably this meant to say
redisGetReplyFromReader which is how redisBufferRead is used in this
file. Could've also meant the interface function redisReaderGetReply.
2018-10-24 23:56:51 +02:00
Mark Nunberg 49974c9359 Call connect(2) again for non-blocking connect
This retrieves the actual error which occurred, as getsockopt is not
always reliable in this regard.
2018-09-25 20:21:37 -04:00
Justin Brewer ef4256670f Update createArray to take size_t
This makes createArray consistent with createString, which also takes
size_t. Bounds-check and unit tests are updated to allow up to
min(SIZE_MAX,LLONG_MAX).

Changelog is updated to mention this API break.

Signed-off-by: Justin Brewer <jzb0012@auburn.edu>
2018-05-21 10:49:30 -05:00
Justin Brewer 58e6b87f51 Remove redundant NULL checks
free(NULL) is a valid NOP. Most of the hiredis free functions behave the
same way. redisReaderFree is updated to also be NULL-safe.

There is one redundant NULL check at sds.c:1036, but it's left as is
since sds is imported from upstream.

Signed-off-by: Justin Brewer <jzb0012@auburn.edu>
2018-04-30 21:45:13 -05:00