* off-by-one in hash iteration when dealing with string keys from char+int -> zend_string

* emalloc -> safe_emalloc
* dump cmd used redis_ping_response, instead of the proper redis_string_response

Author: Sean-Der

redis.c

@@ -1877,11 +1877,6 @@ generic_mset(INTERNAL_FUNCTION_PARAMETERS, char *kw, ResultCallback fun) {
             } else {
                 key_len = key_zstr->len;
                 key = key_zstr->val;
-
-                // When not an integer key, the length will include the \0
-                if (key_len > 0) {
-                    key_len--;
-                }
             }
 
             if(step == 0)
@@ -3277,7 +3272,7 @@ PHP_METHOD(Redis, script) {
     argc = ZEND_NUM_ARGS();
 
     /* Allocate an array big enough to store our arguments */
-    z_args = emalloc(argc * sizeof(zval*));
+	z_args = (zval *) safe_emalloc(sizeof(zval), argc, 0);
 
     /* Make sure we can grab our arguments, we have a string directive */
     if(zend_get_parameters_array(ht, argc, z_args) == FAILURE ||
@@ -3336,7 +3331,7 @@ PHP_METHOD(Redis, script) {
 
 /* {{{ proto DUMP key */
 PHP_METHOD(Redis, dump) {
-    REDIS_PROCESS_KW_CMD("DUMP", redis_key_cmd, redis_ping_response);
+    REDIS_PROCESS_KW_CMD("DUMP", redis_key_cmd, redis_string_response);
 }
 /* }}} */
 
@@ -3643,9 +3638,9 @@ PHP_METHOD(Redis, getAuth) {
 PHP_METHOD(Redis, client) {
     zval *object;
     RedisSock *redis_sock;
-    char *cmd, *opt=NULL, *arg=NULL;
-    int cmd_len;
-    size_t opt_len, arg_len;
+    char *cmd, *opt = NULL, *arg = NULL;
+    int cmd_len = 0;
+    size_t opt_len = 0, arg_len = 0;
 
     // Parse our method parameters
     if(zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(),
@@ -3690,13 +3685,13 @@ PHP_METHOD(Redis, client) {
 
 /* {{{ proto mixed Redis::rawcommand(string $command, [ $arg1 ... $argN]) */
 PHP_METHOD(Redis, rawcommand) {
-    int argc = ZEND_NUM_ARGS(), cmd_len;
+    int argc = ZEND_NUM_ARGS(), cmd_len = 0;
     char *cmd = NULL;
     RedisSock *redis_sock;
     zval *z_args;
 
     /* Sanity check on arguments */
-    z_args = emalloc(argc * sizeof(zval*));
+	z_args = (zval *) safe_emalloc(sizeof(zval), argc, 0);
     if (argc < 1) {
         php_error_docref(NULL TSRMLS_CC, E_WARNING,
             "Must pass at least one command keyword");
@@ -3707,7 +3702,7 @@ PHP_METHOD(Redis, rawcommand) {
             "Internal PHP error parsing arguments");
         efree(z_args);
         RETURN_FALSE;
-    } else if (redis_build_raw_cmd(&z_args, argc, &cmd, &cmd_len TSRMLS_CC) < 0 ||
+    } else if (redis_build_raw_cmd(z_args, argc, &cmd, &cmd_len TSRMLS_CC) < 0 ||
                redis_sock_get(getThis(), &redis_sock TSRMLS_CC, 0) < 0)
     {
         if (cmd) efree(cmd);

redis_cluster.c

@@ -2883,7 +2883,7 @@ PHP_METHOD(RedisCluster, rawcommand) {
             "Internal PHP error parsing method parameters.");
         efree(z_args);
         RETURN_FALSE;
-    } else if (redis_build_raw_cmd(&z_args+1, argc-1, &cmd, &cmd_len TSRMLS_CC) ||
+    } else if (redis_build_raw_cmd(z_args+1, argc-1, &cmd, &cmd_len TSRMLS_CC) ||
                (slot = cluster_cmd_get_slot(c, &z_args[0] TSRMLS_CC))<0)
     {
         if (cmd) efree(cmd);

redis_commands.c

@@ -41,32 +41,32 @@ int redis_empty_cmd(INTERNAL_FUNCTION_PARAMETERS, RedisSock *redis_sock,
 /* Helper to construct a raw command.  Given that the cluster and non cluster
  * versions are different (RedisCluster needs an additional argument to direct
  * the command) we take the start of our array and count */
-int redis_build_raw_cmd(zval **z_args, int argc, char **cmd, int *cmd_len TSRMLS_DC)
+int redis_build_raw_cmd(zval *z_args, int argc, char **cmd, int *cmd_len TSRMLS_DC)
 {
     smart_string cmdstr = {0};
     int i;
 
     /* Make sure our first argument is a string */
-    if (Z_TYPE_P(z_args[0]) != IS_STRING) {
+    if (Z_TYPE(z_args[0]) != IS_STRING) {
         php_error_docref(NULL TSRMLS_CC, E_WARNING,
             "When sending a 'raw' command, the first argument must be a string!");
         return FAILURE;
     }
 
     /* Initialize our command string */
-    redis_cmd_init_sstr(&cmdstr, argc-1, Z_STRVAL_P(z_args[0]), Z_STRLEN_P(z_args[0]));
+    redis_cmd_init_sstr(&cmdstr, argc-1, Z_STRVAL(z_args[0]), Z_STRLEN(z_args[0]));
 
     for (i = 1; i < argc; i++) {
-       switch (Z_TYPE_P(z_args[i])) {
+       switch (Z_TYPE(z_args[i])) {
             case IS_STRING:
-                redis_cmd_append_sstr(&cmdstr, Z_STRVAL_P(z_args[i]),
-                    Z_STRLEN_P(z_args[i]));
+                redis_cmd_append_sstr(&cmdstr, Z_STRVAL(z_args[i]),
+                    Z_STRLEN(z_args[i]));
                 break;
             case IS_LONG:
-                redis_cmd_append_sstr_long(&cmdstr,Z_LVAL_P(z_args[i]));
+                redis_cmd_append_sstr_long(&cmdstr,Z_LVAL(z_args[i]));
                 break;
             case IS_DOUBLE:
-                redis_cmd_append_sstr_dbl(&cmdstr,Z_DVAL_P(z_args[i]));
+                redis_cmd_append_sstr_dbl(&cmdstr,Z_DVAL(z_args[i]));
                 break;
             default:
                 php_error_docref(NULL TSRMLS_CC, E_WARNING,
@@ -1616,7 +1616,7 @@ int redis_hmset_cmd(INTERNAL_FUNCTION_PARAMETERS, RedisSock *redis_sock,
         } else {
             // Length returned includes the \0
             mem = mem_zstring->val;
-            mem_len = mem_zstring->len - 1;
+            mem_len = mem_zstring->len;
         }
 
         // Serialize value (if directed)

redis_commands.h

@@ -22,7 +22,7 @@ typedef struct subscribeContext {
 } subscribeContext;
 
 /* Construct a raw command */
-int redis_build_raw_cmd(zval **z_args, int argc, char **cmd, int *cmd_len TSRMLS_DC);
+int redis_build_raw_cmd(zval *z_args, int argc, char **cmd, int *cmd_len TSRMLS_DC);
 
 /* Redis command generics.  Many commands share common prototypes meaning that
  * we can write one function to handle all of them.  For example, there are
@@ -44,7 +44,7 @@ int redis_kv_cmd(INTERNAL_FUNCTION_PARAMETERS, RedisSock *redis_sock,
     char *kw, char **cmd, int *cmd_len, short *slot, void **ctx);
 
 int redis_key_str_cmd(INTERNAL_FUNCTION_PARAMETERS, RedisSock *redis_sock,
-    char *kw, char **cmd, int *cmd_len, short *slot, void **ctx);     
+    char *kw, char **cmd, int *cmd_len, short *slot, void **ctx);
 
 int redis_key_key_cmd(INTERNAL_FUNCTION_PARAMETERS, RedisSock *redis_sock,
     char *kw, char **cmd, int *cmd_len, short *slot, void **ctx);
@@ -79,11 +79,11 @@ typedef int (*zrange_cb)(INTERNAL_FUNCTION_PARAMETERS, RedisSock *redis_sock,
                          char *,char**,int*,int*,short*,void**);
 
 int redis_zrange_cmd(INTERNAL_FUNCTION_PARAMETERS, RedisSock *redis_sock,
-    char *kw, char **cmd, int *cmd_len, int *withscores, short *slot, 
+    char *kw, char **cmd, int *cmd_len, int *withscores, short *slot,
     void **ctx);
 
 int redis_zrangebyscore_cmd(INTERNAL_FUNCTION_PARAMETERS, RedisSock *redis_sock,
-    char *kw, char **cmd, int *cmd_len, int *withscores, short *slot, 
+    char *kw, char **cmd, int *cmd_len, int *withscores, short *slot,
     void **ctx);
 
 int redis_zinter_cmd(INTERNAL_FUNCTION_PARAMETERS, RedisSock *redis_sock,
@@ -102,7 +102,7 @@ int redis_gen_zlex_cmd(INTERNAL_FUNCTION_PARAMETERS, RedisSock *redis_sock,
     char *kw, char **cmd, int *cmd_len, short *slot, void **ctx);
 
 /* Commands which need a unique construction mechanism.  This is either because
- * they don't share a signature with any other command, or because there is 
+ * they don't share a signature with any other command, or because there is
  * specific processing we do (e.g. verifying subarguments) that make them
  * unique */
 
@@ -130,7 +130,7 @@ int redis_hmget_cmd(INTERNAL_FUNCTION_PARAMETERS, RedisSock *redis_sock,
 int redis_hmset_cmd(INTERNAL_FUNCTION_PARAMETERS, RedisSock *redis_sock,
     char **cmd, int *cmd_len, short *slot, void **ctx);
 
-int redis_bitop_cmd(INTERNAL_FUNCTION_PARAMETERS, RedisSock *redis_sock, 
+int redis_bitop_cmd(INTERNAL_FUNCTION_PARAMETERS, RedisSock *redis_sock,
     char **cmd, int *cmd_len, short *slot, void **ctx);
 
 int redis_bitcount_cmd(INTERNAL_FUNCTION_PARAMETERS, RedisSock *redis_sock,
@@ -224,20 +224,20 @@ int redis_command_cmd(INTERNAL_FUNCTION_PARAMETERS, RedisSock *redis_sock,
 int redis_fmt_scan_cmd(char **cmd, REDIS_SCAN_TYPE type, char *key, int key_len,
                        long it, char *pat, int pat_len, long count);
 
-/* Commands that don't communicate with Redis at all (such as getOption, 
+/* Commands that don't communicate with Redis at all (such as getOption,
  * setOption, _prefix, _serialize, etc).  These can be handled in one place
- * with the method of grabbing our RedisSock* object in different ways 
+ * with the method of grabbing our RedisSock* object in different ways
  * depending if this is a Redis object or a RedisCluster object. */
 
-void redis_getoption_handler(INTERNAL_FUNCTION_PARAMETERS, 
+void redis_getoption_handler(INTERNAL_FUNCTION_PARAMETERS,
     RedisSock *redis_sock, redisCluster *c);
-void redis_setoption_handler(INTERNAL_FUNCTION_PARAMETERS, 
+void redis_setoption_handler(INTERNAL_FUNCTION_PARAMETERS,
     RedisSock *redis_sock, redisCluster *c);
-void redis_prefix_handler(INTERNAL_FUNCTION_PARAMETERS, 
+void redis_prefix_handler(INTERNAL_FUNCTION_PARAMETERS,
     RedisSock *redis_sock);
-void redis_serialize_handler(INTERNAL_FUNCTION_PARAMETERS, 
+void redis_serialize_handler(INTERNAL_FUNCTION_PARAMETERS,
     RedisSock *redis_sock);
-void redis_unserialize_handler(INTERNAL_FUNCTION_PARAMETERS, 
+void redis_unserialize_handler(INTERNAL_FUNCTION_PARAMETERS,
     RedisSock *redis_sock, zend_class_entry *ex);
 
 #endif