summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2021-10-10Minor refactor of CVE-2021-32765 fix.michael-grunder
Since `hi_calloc` always passes through one of our wrapper functions, we can perform this overflow in the wrapper, and get protection everywhere. Previous commit: 76a7b10005c70babee357a7d0f2becf28ec7ed1e Related vuln ID: CVE-2021-32765 [Full Details](https://github.com/redis/hiredis/security/advisories/GHSA-hfm9-39pp-55p2)
2021-10-09Remove extra comma from cmake var.Tongliang Liao
Or it'll be treated as part of the var name.
2021-10-07Merge branch 'release/v1.0.2'michael-grunder
2021-10-07Prepare for v1.0.2 GAmichael-grunder
2021-10-07Revert erroneous SONAME bumpmichael-grunder
2021-10-04Merge branch 'release/v1.0.1'michael-grunder
Merge the v1.0.1 release branch and bump the dev version to 1.0.2-dev
2021-10-04 Prepare for v1.0.1 GAmichael-grunder
2021-10-04Fix for integer/buffer overflow CVE-2021-32765Yossi Gottlieb
This fix prevents hiredis from trying to allocate more than `SIZE_MAX` bytes, which would result in a buffer overrun. [Full Details](https://github.com/redis/hiredis/security/advisories/GHSA-hfm9-39pp-55p2)
2021-10-03Allow to override OPENSSL_PREFIX in LinuxYunier Perez
2021-08-18Don't leak memory if an invalid type is set (#906)rouzier
Co-authored-by: James Rouzier <jrouzier@inverse.ca>
2021-07-11Added REDIS_NO_AUTO_FREE_REPLIES flag (#962)Meir Shpilraien (Spielrein)
When set hiredis will not automatically free replies in an async context, and the replies must be freed instead by the user. Co-authored-by: Michael Grunder <michael.grunder@gmail.com>
2021-06-17Ensure we curry any connect error to an async context.michael-grunder
2021-05-23Fix README.mdmichael-grunder
Closes #929
2021-05-02Merge pull request #935 from kristjanvalur/pr5Michael Grunder
Bugfix: Ignore timeout callback from a successful connect (fixes #945)
2021-05-02Merge pull request #939 from zmartzone/improve_pr_896_ssl_leakMichael Grunder
improve SSL leak fix redis/hiredis#896
2021-05-02Merge pull request #949 from plan-do-break-fix/Typo-correctionsMichael Grunder
fix(docs): corrects typos in project README
2021-04-24fix(docs): corrects typos in project READMEplan-do-break-fix
2021-04-11improve SSL leak fix redis/hiredis#896Hans Zandbelt
Free SSL object when redisSSLConnect fails but avoid doing that for callers of redisInitiateSSL who are supposed to manager their own SSL object. Signed-off-by: Hans Zandbelt <hans.zandbelt@zmartzone.eu>
2021-04-08Ignore timeout callback from a successful connectKristján Valur Jónsson
2021-04-02Change order independant push logic to not change behavior.michael-grunder
Since redisGetReplyFromReader is exposed in a header file, we probably shouldn't modify how it behaves in any way. For this reason, handle the changed logic in an internal static helper method.
2021-04-02Handle the case where an invalidation is sent second.michael-grunder
RESP3 invalidation messages always seemed to be sent before the response to a given command, but it appears this is not always the case: In Redis 6.2.0RC1 Redis sends the invalidation after the HSET in the following sequence: ``` hget hash field $5 value hset hash field value :0 >2 $10 invalidate *1 $4 hash ``` To account for this possibility just wrap redisGetReplyFromReader in a loop as it is called twice in redisGetReply.
2021-02-25Merge branch 'reader-updates'michael-grunder
Updates and improvements to the RESP3 protocol reader. * Fix the unset len field when creating RESP3 double objects * Fix RESP3 double infinity parsing * Add additional validations when parsing various reply types * Fix the parent type assertions in certain default reply object creation callbacks (mostly to include PUSH as a parent). * Additional reader test cases * Implement RESP3 BIGNUM support * Refactor seekNewline() to use memchr()
2021-02-25Fix off-by-one error in seekNewlinemichael-grunder
2021-02-25read: Validate line items prior to checking for object creation callbacksAlex Smith
2021-02-25read: Remove obsolete comment on nested multi bulk depth limitationAlex Smith
2021-02-25read: Add support for the RESP3 bignum typeAlex Smith
2021-02-25read: Ensure no invalid '\r' or '\n' in simple status/error stringsAlex Smith
2021-02-25read: Additional validation and test case for RESP3 doubleAlex Smith
This ensures that malformed RESP3 double messages that include an invalid null byte are not parsed as valid.
2021-02-25redisReply: Fix parent type assertions during double, nil, bool creationAlex Smith
Per RESP3, push messages are able to contain exactly what array messages can contain (that is, any other type).
2021-02-25redisReply: Explicitly list nil and bool cases in freeReplyObject() switch.Alex Smith
2021-02-25test: Add test case for RESP3 setAlex Smith
2021-02-25test: Add test case for RESP3 mapAlex Smith
2021-02-25read: Use memchr() in seekNewline() instead of looping over entire stringAlex Smith
2021-02-25test: Add test cases for RESP3 boolAlex Smith
2021-02-25read: Add additional RESP3 bool validationAlex Smith
RESP3 bools should be only one of "#t\r\n" or "#f\r\n". We also allow capital 'T' and 'F' to be lenient.
2021-02-25test: Add test cases for RESP3 nilAlex Smith
2021-02-25read: Add additional RESP3 nil validationAlex Smith
RESP3 nil should consist of "_\r\n" and nothing else.
2021-02-25test: Add test cases for infinite and NaN doublesAlex Smith
2021-02-25read: Fix double validation and infinity parsingAlex Smith
The ',' protocol byte gets removed in processItem(), so it should not be compared against in processLineItem(). strtod() allows multiple representations of infinity and NaN that are not RESP3 compliant. Since we explicitly check for the two compliant infinity cases, strtod() should only return finite values.
2021-02-25test: Add test case for doublesAlex Smith
2021-02-25redisReply: Fix - set len in double objectsAlex Smith
2021-02-17Merge pull request #924 from cheese1/masterMichael Grunder
http -> https
2021-02-17http -> httpscheese1
2021-01-26Merge pull request #917 from Nordix/stack-alloc-dict-iterMichael Grunder
Stack allocate dict iterators
2021-01-26Handle OOM during async command callback registrationBjorn Svensson
Unless the callback is pushed to the list it will trigger an assert in redisProcessCallbacks() when the response arrives. This change let the user get an early error instead, available in the async context directly.
2021-01-25Stack allocate dict iteratorsBjorn Svensson
Replacing the get & release functions with an initiation function. Simplifies the code and will make sure we run subscription callbacks in OOM scenarios.
2020-12-12Tiny formatting changes + suppress implicit memcpy warningmichael-grunder
2020-12-12Removed 2 typecastsAdamKorcz
2020-12-11Added fuzzerAdamKorcz
2020-11-15Merge pull request #896 from ayeganov/bugfix/ssl_leakMichael Grunder
Free SSL object when redisSSLConnect fails
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-20 14:21:49 +0000