From 44bc9cfbcf0794de92da28d9aaaa46d62945ce4e Mon Sep 17 00:00:00 2001 From: Brian Aker Date: Thu, 10 Feb 2011 10:43:18 -0800 Subject: [PATCH] Fix for bug 633247 --- ChangeLog | 3 +++ libmemcached/auto.c | 18 +++++++-------- libmemcached/connect.c | 4 +++- libmemcached/delete.c | 31 +++++++++++++------------ libmemcached/dump.c | 13 +++++++---- libmemcached/flush.c | 32 +++++++++++++++---------- libmemcached/hosts.c | 50 ++++++++++++++++++++++++---------------- libmemcached/stats.c | 12 +++++++--- libmemcached/storage.c | 48 +++++++++++++++++++++++++++----------- libmemcached/verbosity.c | 8 +++---- 10 files changed, 137 insertions(+), 82 deletions(-) diff --git a/ChangeLog b/ChangeLog index f2e3f580..ca2fe281 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,6 @@ + * Bug lp:633247 + + 0.45 Tue Feb 8 16:02:06 PST 2011 * Add support for systemtap diff --git a/libmemcached/auto.c b/libmemcached/auto.c index ce2d0261..a221144f 100644 --- a/libmemcached/auto.c +++ b/libmemcached/auto.c @@ -18,7 +18,6 @@ static memcached_return_t text_incr_decr(memcached_st *ptr, uint64_t offset, uint64_t *value) { - size_t send_length; memcached_return_t rc; char buffer[MEMCACHED_DEFAULT_COMMAND_SIZE]; uint32_t server_key; @@ -34,16 +33,17 @@ static memcached_return_t text_incr_decr(memcached_st *ptr, server_key= memcached_generate_hash_with_redistribution(ptr, master_key, master_key_length); instance= memcached_server_instance_fetch(ptr, server_key); - send_length= (size_t)snprintf(buffer, MEMCACHED_DEFAULT_COMMAND_SIZE, - "%s %.*s%.*s %" PRIu64 "%s\r\n", verb, - (int)ptr->prefix_key_length, - ptr->prefix_key, - (int)key_length, key, - offset, no_reply ? " noreply" : ""); - unlikely (send_length >= MEMCACHED_DEFAULT_COMMAND_SIZE) + int send_length; + send_length= snprintf(buffer, MEMCACHED_DEFAULT_COMMAND_SIZE, + "%s %.*s%.*s %" PRIu64 "%s\r\n", verb, + (int)ptr->prefix_key_length, + ptr->prefix_key, + (int)key_length, key, + offset, no_reply ? " noreply" : ""); + if (send_length >= MEMCACHED_DEFAULT_COMMAND_SIZE || send_length < 0) return MEMCACHED_WRITE_FAILURE; - rc= memcached_do(instance, buffer, send_length, true); + rc= memcached_do(instance, buffer, (size_t)send_length, true); if (no_reply || rc != MEMCACHED_SUCCESS) return rc; diff --git a/libmemcached/connect.c b/libmemcached/connect.c index c4b263e1..75d174b4 100644 --- a/libmemcached/connect.c +++ b/libmemcached/connect.c @@ -95,7 +95,9 @@ static memcached_return_t set_hostinfo(memcached_server_st *server) char str_port[NI_MAXSERV]; uint32_t counter= 5; - snprintf(str_port, NI_MAXSERV, "%u", (uint32_t)server->port); + int length= snprintf(str_port, NI_MAXSERV, "%u", (uint32_t)server->port); + if (length >= NI_MAXSERV || length < 0) + return MEMCACHED_FAILURE; memset(&hints, 0, sizeof(hints)); diff --git a/libmemcached/delete.c b/libmemcached/delete.c index 84a34271..ef1fa6da 100644 --- a/libmemcached/delete.c +++ b/libmemcached/delete.c @@ -20,7 +20,6 @@ memcached_return_t memcached_delete_by_key(memcached_st *ptr, time_t expiration) { bool to_write; - size_t send_length; memcached_return_t rc; char buffer[MEMCACHED_DEFAULT_COMMAND_SIZE]; uint32_t server_key; @@ -56,6 +55,8 @@ memcached_return_t memcached_delete_by_key(memcached_st *ptr, } else { + int send_length; + unlikely (expiration) { if ((instance->major_version == 1 && @@ -89,25 +90,25 @@ memcached_return_t memcached_delete_by_key(memcached_st *ptr, no_reply= false; } } - send_length= (size_t) snprintf(buffer, MEMCACHED_DEFAULT_COMMAND_SIZE, - "delete %.*s%.*s %u%s\r\n", - (int)ptr->prefix_key_length, - ptr->prefix_key, - (int) key_length, key, - (uint32_t)expiration, - no_reply ? " noreply" :"" ); + send_length= snprintf(buffer, MEMCACHED_DEFAULT_COMMAND_SIZE, + "delete %.*s%.*s %u%s\r\n", + (int)ptr->prefix_key_length, + ptr->prefix_key, + (int) key_length, key, + (uint32_t)expiration, + no_reply ? " noreply" :"" ); } } else { - send_length= (size_t) snprintf(buffer, MEMCACHED_DEFAULT_COMMAND_SIZE, - "delete %.*s%.*s%s\r\n", - (int)ptr->prefix_key_length, - ptr->prefix_key, - (int)key_length, key, no_reply ? " noreply" :""); + send_length= snprintf(buffer, MEMCACHED_DEFAULT_COMMAND_SIZE, + "delete %.*s%.*s%s\r\n", + (int)ptr->prefix_key_length, + ptr->prefix_key, + (int)key_length, key, no_reply ? " noreply" :""); } - if (send_length >= MEMCACHED_DEFAULT_COMMAND_SIZE) + if (send_length >= MEMCACHED_DEFAULT_COMMAND_SIZE || send_length < 0) { rc= MEMCACHED_WRITE_FAILURE; goto error; @@ -121,7 +122,7 @@ memcached_return_t memcached_delete_by_key(memcached_st *ptr, memcached_io_write(instance, NULL, 0, true); } - rc= memcached_do(instance, buffer, send_length, to_write); + rc= memcached_do(instance, buffer, (size_t)send_length, to_write); } if (rc != MEMCACHED_SUCCESS) diff --git a/libmemcached/dump.c b/libmemcached/dump.c index a0d62df0..9ec2dab5 100644 --- a/libmemcached/dump.c +++ b/libmemcached/dump.c @@ -11,7 +11,6 @@ static memcached_return_t ascii_dump(memcached_st *ptr, memcached_dump_fn *callb { memcached_return_t rc= MEMCACHED_SUCCESS; char buffer[MEMCACHED_DEFAULT_COMMAND_SIZE]; - size_t send_length; uint32_t server_key; uint32_t x; @@ -26,10 +25,16 @@ static memcached_return_t ascii_dump(memcached_st *ptr, memcached_dump_fn *callb /* 256 I BELIEVE is the upper limit of slabs */ for (x= 0; x < 256; x++) { - send_length= (size_t) snprintf(buffer, MEMCACHED_DEFAULT_COMMAND_SIZE, - "stats cachedump %u 0 0\r\n", x); + int send_length; + send_length= snprintf(buffer, MEMCACHED_DEFAULT_COMMAND_SIZE, + "stats cachedump %u 0 0\r\n", x); - rc= memcached_do(instance, buffer, send_length, true); + if (send_length >= MEMCACHED_DEFAULT_COMMAND_SIZE || send_length < 0) + { + return MEMCACHED_FAILURE; + } + + rc= memcached_do(instance, buffer, (size_t)send_length, true); unlikely (rc != MEMCACHED_SUCCESS) goto error; diff --git a/libmemcached/flush.c b/libmemcached/flush.c index 425d4576..5aaffa56 100644 --- a/libmemcached/flush.c +++ b/libmemcached/flush.c @@ -21,29 +21,37 @@ memcached_return_t memcached_flush(memcached_st *ptr, time_t expiration) static memcached_return_t memcached_flush_textual(memcached_st *ptr, time_t expiration) { - unsigned int x; - size_t send_length; - memcached_return_t rc; - char buffer[MEMCACHED_DEFAULT_COMMAND_SIZE]; - unlikely (memcached_server_count(ptr) == 0) return MEMCACHED_NO_SERVERS; - for (x= 0; x < memcached_server_count(ptr); x++) + for (unsigned int x= 0; x < memcached_server_count(ptr); x++) { + memcached_return_t rc; + char buffer[MEMCACHED_DEFAULT_COMMAND_SIZE]; + bool no_reply= ptr->flags.no_reply; memcached_server_write_instance_st instance= memcached_server_instance_fetch(ptr, x); + int send_length; if (expiration) - send_length= (size_t) snprintf(buffer, MEMCACHED_DEFAULT_COMMAND_SIZE, - "flush_all %llu%s\r\n", - (unsigned long long)expiration, no_reply ? " noreply" : ""); + { + send_length= snprintf(buffer, MEMCACHED_DEFAULT_COMMAND_SIZE, + "flush_all %llu%s\r\n", + (unsigned long long)expiration, no_reply ? " noreply" : ""); + } else - send_length= (size_t) snprintf(buffer, MEMCACHED_DEFAULT_COMMAND_SIZE, - "flush_all%s\r\n", no_reply ? " noreply" : ""); + { + send_length= snprintf(buffer, MEMCACHED_DEFAULT_COMMAND_SIZE, + "flush_all%s\r\n", no_reply ? " noreply" : ""); + } + + if (send_length >= MEMCACHED_DEFAULT_COMMAND_SIZE || send_length < 0) + { + return MEMCACHED_FAILURE; + } - rc= memcached_do(instance, buffer, send_length, true); + rc= memcached_do(instance, buffer, (size_t)send_length, true); if (rc == MEMCACHED_SUCCESS && !no_reply) (void)memcached_response(instance, buffer, MEMCACHED_DEFAULT_COMMAND_SIZE, NULL); diff --git a/libmemcached/hosts.c b/libmemcached/hosts.c index 4018a258..ec12c92f 100644 --- a/libmemcached/hosts.c +++ b/libmemcached/hosts.c @@ -206,15 +206,20 @@ static memcached_return_t update_continuum(memcached_st *ptr) pointer_index++) { char sort_host[MEMCACHED_MAX_HOST_SORT_LENGTH]= ""; - size_t sort_host_length; + int sort_host_length; // Spymemcached ketema key format is: hostname/ip:port-index // If hostname is not available then: /ip:port-index - sort_host_length= (size_t) snprintf(sort_host, MEMCACHED_MAX_HOST_SORT_LENGTH, - "/%s:%u-%u", - list[host_index].hostname, - (uint32_t)list[host_index].port, - pointer_index); + sort_host_length= snprintf(sort_host, MEMCACHED_MAX_HOST_SORT_LENGTH, + "/%s:%u-%u", + list[host_index].hostname, + (uint32_t)list[host_index].port, + pointer_index); + + if (sort_host_length >= MEMCACHED_MAX_HOST_SORT_LENGTH || sort_host_length < 0) + { + return MEMCACHED_FAILURE; + } #ifdef DEBUG printf("update_continuum: key is %s\n", sort_host); #endif @@ -225,14 +230,14 @@ static memcached_return_t update_continuum(memcached_st *ptr) { for (uint32_t x= 0; x < pointer_per_hash; x++) { - value= ketama_server_hash(sort_host, sort_host_length, x); + value= ketama_server_hash(sort_host, (size_t)sort_host_length, x); ptr->continuum[continuum_index].index= host_index; ptr->continuum[continuum_index++].value= value; } } else { - value= hashkit_digest(&ptr->distribution_hashkit, sort_host, sort_host_length); + value= hashkit_digest(&ptr->distribution_hashkit, sort_host, (size_t)sort_host_length); ptr->continuum[continuum_index].index= host_index; ptr->continuum[continuum_index++].value= value; } @@ -245,22 +250,27 @@ static memcached_return_t update_continuum(memcached_st *ptr) pointer_index++) { char sort_host[MEMCACHED_MAX_HOST_SORT_LENGTH]= ""; - size_t sort_host_length; + int sort_host_length; if (list[host_index].port == MEMCACHED_DEFAULT_PORT) { - sort_host_length= (size_t) snprintf(sort_host, MEMCACHED_MAX_HOST_SORT_LENGTH, - "%s-%u", - list[host_index].hostname, - pointer_index - 1); + sort_host_length= snprintf(sort_host, MEMCACHED_MAX_HOST_SORT_LENGTH, + "%s-%u", + list[host_index].hostname, + pointer_index - 1); } else { - sort_host_length= (size_t) snprintf(sort_host, MEMCACHED_MAX_HOST_SORT_LENGTH, - "%s:%u-%u", - list[host_index].hostname, - (uint32_t)list[host_index].port, - pointer_index - 1); + sort_host_length= snprintf(sort_host, MEMCACHED_MAX_HOST_SORT_LENGTH, + "%s:%u-%u", + list[host_index].hostname, + (uint32_t)list[host_index].port, + pointer_index - 1); + } + + if (sort_host_length >= MEMCACHED_MAX_HOST_SORT_LENGTH || sort_host_length < 0) + { + return MEMCACHED_FAILURE; } WATCHPOINT_ASSERT(sort_host_length); @@ -269,14 +279,14 @@ static memcached_return_t update_continuum(memcached_st *ptr) { for (uint32_t x = 0; x < pointer_per_hash; x++) { - value= ketama_server_hash(sort_host, sort_host_length, x); + value= ketama_server_hash(sort_host, (size_t)sort_host_length, x); ptr->continuum[continuum_index].index= host_index; ptr->continuum[continuum_index++].value= value; } } else { - value= hashkit_digest(&ptr->distribution_hashkit, sort_host, sort_host_length); + value= hashkit_digest(&ptr->distribution_hashkit, sort_host, (size_t)sort_host_length); ptr->continuum[continuum_index].index= host_index; ptr->continuum[continuum_index++].value= value; } diff --git a/libmemcached/stats.c b/libmemcached/stats.c index 0c52d97a..ab005f49 100644 --- a/libmemcached/stats.c +++ b/libmemcached/stats.c @@ -227,6 +227,12 @@ char *memcached_stat_get_value(const memcached_st *ptr, memcached_stat_st *memc_ return NULL; } + if (length >= SMALL_STRING_LEN || length < 0) + { + *error= MEMCACHED_FAILURE; + return NULL; + } + ret= libmemcached_malloc(ptr, (size_t) (length + 1)); memcpy(ret, buffer, (size_t) length); ret[length]= '\0'; @@ -329,7 +335,7 @@ static memcached_return_t ascii_stats_fetch(memcached_stat_st *memc_stat, { memcached_return_t rc; char buffer[MEMCACHED_DEFAULT_COMMAND_SIZE]; - size_t send_length; + int send_length; if (args) send_length= (size_t) snprintf(buffer, MEMCACHED_DEFAULT_COMMAND_SIZE, @@ -338,10 +344,10 @@ static memcached_return_t ascii_stats_fetch(memcached_stat_st *memc_stat, send_length= (size_t) snprintf(buffer, MEMCACHED_DEFAULT_COMMAND_SIZE, "stats\r\n"); - if (send_length >= MEMCACHED_DEFAULT_COMMAND_SIZE) + if (send_length >= MEMCACHED_DEFAULT_COMMAND_SIZE || send_length < 0) return MEMCACHED_WRITE_FAILURE; - rc= memcached_do(instance, buffer, send_length, true); + rc= memcached_do(instance, buffer, (size_t)send_length, true); if (rc != MEMCACHED_SUCCESS) goto error; diff --git a/libmemcached/storage.c b/libmemcached/storage.c index 25aaba30..782a3766 100644 --- a/libmemcached/storage.c +++ b/libmemcached/storage.c @@ -104,15 +104,24 @@ static inline memcached_return_t memcached_send(memcached_st *ptr, if (cas) { - write_length= (size_t) snprintf(buffer, MEMCACHED_DEFAULT_COMMAND_SIZE, - "%s %.*s%.*s %u %llu %zu %llu%s\r\n", - storage_op_string(verb), - (int)ptr->prefix_key_length, - ptr->prefix_key, - (int)key_length, key, flags, - (unsigned long long)expiration, value_length, - (unsigned long long)cas, - (ptr->flags.no_reply) ? " noreply" : ""); + int check_length; + check_length= snprintf(buffer, MEMCACHED_DEFAULT_COMMAND_SIZE, + "%s %.*s%.*s %u %llu %zu %llu%s\r\n", + storage_op_string(verb), + (int)ptr->prefix_key_length, + ptr->prefix_key, + (int)key_length, key, flags, + (unsigned long long)expiration, value_length, + (unsigned long long)cas, + (ptr->flags.no_reply) ? " noreply" : ""); + if (check_length >= MEMCACHED_DEFAULT_COMMAND_SIZE || check_length < 0) + { + rc= MEMCACHED_WRITE_FAILURE; + memcached_io_reset(instance); + + return rc; + } + write_length= check_length; } else { @@ -133,11 +142,22 @@ static inline memcached_return_t memcached_send(memcached_st *ptr, buffer_ptr++; write_length= (size_t)(buffer_ptr - buffer); - write_length+= (size_t) snprintf(buffer_ptr, MEMCACHED_DEFAULT_COMMAND_SIZE, - "%u %llu %zu%s\r\n", - flags, - (unsigned long long)expiration, value_length, - ptr->flags.no_reply ? " noreply" : ""); + int check_length; + check_length= snprintf(buffer_ptr, MEMCACHED_DEFAULT_COMMAND_SIZE -(size_t)(buffer_ptr - buffer), + "%u %llu %zu%s\r\n", + flags, + (unsigned long long)expiration, value_length, + ptr->flags.no_reply ? " noreply" : ""); + if ((size_t)check_length >= MEMCACHED_DEFAULT_COMMAND_SIZE -(size_t)(buffer_ptr - buffer) || check_length < 0) + { + rc= MEMCACHED_WRITE_FAILURE; + memcached_io_reset(instance); + + return rc; + } + + write_length+= (size_t)check_length; + WATCHPOINT_ASSERT(write_length < MEMCACHED_DEFAULT_COMMAND_SIZE); } if (ptr->flags.use_udp && ptr->flags.buffer_requests) diff --git a/libmemcached/verbosity.c b/libmemcached/verbosity.c index fba00144..d0903514 100644 --- a/libmemcached/verbosity.c +++ b/libmemcached/verbosity.c @@ -41,17 +41,17 @@ static memcached_return_t _set_verbosity(const memcached_st *ptr __attribute__(( memcached_return_t memcached_verbosity(memcached_st *ptr, uint32_t verbosity) { - size_t send_length; + int send_length; memcached_server_fn callbacks[1]; char buffer[MEMCACHED_DEFAULT_COMMAND_SIZE]; - send_length= (size_t) snprintf(buffer, MEMCACHED_DEFAULT_COMMAND_SIZE, + send_length= snprintf(buffer, MEMCACHED_DEFAULT_COMMAND_SIZE, "verbosity %u\r\n", verbosity); - unlikely (send_length >= MEMCACHED_DEFAULT_COMMAND_SIZE) + if (send_length >= MEMCACHED_DEFAULT_COMMAND_SIZE || send_length < 0) return MEMCACHED_WRITE_FAILURE; - struct context_st context = { .length= send_length, .buffer= buffer }; + struct context_st context = { .length= (size_t)send_length, .buffer= buffer }; callbacks[0]= _set_verbosity; -- 2.30.2