From 08c3fe8063b0a7e477dee8036ff5409a48c6f9a9 Mon Sep 17 00:00:00 2001 From: Eran Liberty Date: Thu, 5 Dec 2019 13:37:11 +0000 Subject: [PATCH 1/2] - memcpy(&id,ri.key,ri.key_len); + memcpy(&id,ri.key,sizeof(id)); The memcpy from the key to the id reliease on the fact that this key *should* be 8 bytes long as it was entered as such a few lines up the code. BUT if someone will change the code to the point this is no longer true, current code can trash the stack which makes debugging very hard while this fix will result in some garbage id, or even page fault. Both are preferable to stack mangaling. --- src/tracking.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/tracking.c b/src/tracking.c index f7f0fc755..acb97800a 100644 --- a/src/tracking.c +++ b/src/tracking.c @@ -164,7 +164,7 @@ void trackingInvalidateSlot(uint64_t slot) { raxSeek(&ri,"^",NULL,0); while(raxNext(&ri)) { uint64_t id; - memcpy(&id,ri.key,ri.key_len); + memcpy(&id,ri.key,sizeof(id)); client *c = lookupClientByID(id); if (c == NULL || !(c->flags & CLIENT_TRACKING)) continue; sendTrackingMessage(c,slot); From 5941730c3770cfff0f753403378854e16e3c7d67 Mon Sep 17 00:00:00 2001 From: Oran Agra Date: Mon, 9 Dec 2019 10:03:23 +0200 Subject: [PATCH 2/2] Add ULL suffix to CLIENT_TRACKING flag to prevent sign extension the code in: c->flags &= ~(CLIENT_TRACKING|CLIENT_TRACKING_BROKEN_REDIR); will do sign extension and turn on all the high 31 bits no damage so far since we don't have any yet --- src/server.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/server.h b/src/server.h index d251fa026..f2c93241c 100644 --- a/src/server.h +++ b/src/server.h @@ -239,7 +239,7 @@ typedef long long ustime_t; /* microsecond time type. */ we return single threaded that the client has already pending commands to be executed. */ -#define CLIENT_TRACKING (1<<31) /* Client enabled keys tracking in order to +#define CLIENT_TRACKING (1ULL<<31) /* Client enabled keys tracking in order to perform client side caching. */ #define CLIENT_TRACKING_BROKEN_REDIR (1ULL<<32) /* Target client is invalid. */