diff options
| author | antirez <antirez@gmail.com> | 2016-01-19 13:16:24 +0100 |
|---|---|---|
| committer | antirez <antirez@gmail.com> | 2016-01-19 13:18:08 +0100 |
| commit | 53edd42a4e6c58a9623eabfa15777e05254098e4 (patch) | |
| tree | c9228a49034c6fb5a0f867624b713b59528243b1 | |
| parent | e50b9a0757f9e6432c5b8e1f05fee03c0576a7ca (diff) | |
| download | redis-53edd42a4e6c58a9623eabfa15777e05254098e4.tar.gz | |
Cluster: check packets length before accessing far fields.
| -rw-r--r-- | src/cluster.c | 15 |
1 files changed, 10 insertions, 5 deletions
diff --git a/src/cluster.c b/src/cluster.c index 20ba7f4eb..881b6178b 100644 --- a/src/cluster.c +++ b/src/cluster.c @@ -1544,9 +1544,6 @@ int clusterProcessPacket(clusterLink *link) { clusterMsg *hdr = (clusterMsg*) link->rcvbuf; uint32_t totlen = ntohl(hdr->totlen); uint16_t type = ntohs(hdr->type); - uint16_t flags = ntohs(hdr->flags); - uint64_t senderCurrentEpoch = 0, senderConfigEpoch = 0; - clusterNode *sender; server.cluster->stats_bus_messages_received++; redisLog(REDIS_DEBUG,"--- Processing packet of type %d, %lu bytes", @@ -1554,9 +1551,17 @@ int clusterProcessPacket(clusterLink *link) { /* Perform sanity checks */ if (totlen < 16) return 1; /* At least signature, version, totlen, count. */ - if (ntohs(hdr->ver) != CLUSTER_PROTO_VER) - return 1; /* Can't handle versions other than the current one.*/ if (totlen > sdslen(link->rcvbuf)) return 1; + + if (ntohs(hdr->ver) != CLUSTER_PROTO_VER) { + /* Can't handle messages of different versions. */ + return 1; + } + + uint16_t flags = ntohs(hdr->flags); + uint64_t senderCurrentEpoch = 0, senderConfigEpoch = 0; + clusterNode *sender; + if (type == CLUSTERMSG_TYPE_PING || type == CLUSTERMSG_TYPE_PONG || type == CLUSTERMSG_TYPE_MEET) { |