dalli 5.2.5 → 5.3.0

data/lib/dalli/protocol/connection_manager.rb

@@ -21,7 +21,10 @@ module Dalli
         # amount of time to sleep between retries when a failure occurs
         socket_failure_delay: 0.1,
         # Set keepalive
-        keepalive: true
+        keepalive: true,
+        # On JRuby and TruffleRuby, time out reads after socket_timeout (see
+        # ReadTimeout). CRuby always does.
+        enforce_read_timeout: false
       }.freeze
 
       attr_accessor :hostname, :port, :socket_type, :options
@@ -36,6 +39,7 @@ module Dalli
         @socket_type = socket_type
         @options = DEFAULTS.merge(client_options)
         @request_in_progress = false
+        @request_sent = false
         @quiet_responses_pending = false
         @sock = nil
         @pid = nil
@@ -45,6 +49,7 @@ module Dalli
 
         @fail_count = 0
         reset_down_info
+        extend ReadTimeout if @options[:enforce_read_timeout] && RUBY_ENGINE != 'ruby'
       end
 
       def name
@@ -64,6 +69,7 @@ module Dalli
         @pid = Process.pid
         @request_in_progress = false
         @quiet_responses_pending = false
+        @last_used_at = Process.clock_gettime(Process::CLOCK_MONOTONIC, :millisecond)
       rescue SystemCallError, *TIMEOUT_ERRORS, *SSL_ERRORS, EOFError, SocketError => e
         # SocketError = DNS resolution failure; SSL_ERRORS = failed TLS handshake
         error_on_request!(e)
@@ -109,9 +115,46 @@ module Dalli
         @socket_timeout ||= @options[:socket_timeout]
       end
 
+      # Before a request: closes a connection left mid-request, reconnects
+      # after a fork, and checks a connection that sat idle (see
+      # #close_if_closed_by_peer!). Idle time runs from the start of the last
+      # request, so the clock is read once per request; after a request that
+      # itself took over a second, the next just makes a check that finds
+      # nothing. Pending quiet replies are readable and expected, so the
+      # check, and the clock read, are skipped while there are any; in a quiet
+      # block that is every write after the first.
       def confirm_ready!
         close if request_in_progress?
         reconnect_on_fork if fork_detected?
+        return if @sock.nil? || @quiet_responses_pending
+
+        now = Process.clock_gettime(Process::CLOCK_MONOTONIC, :millisecond)
+        idle = now - @last_used_at
+        @last_used_at = now
+        close_if_closed_by_peer! if idle >= IDLE_CHECK_MS
+      end
+
+      # How long, in milliseconds, a connection goes without a request before
+      # the next one first checks that the server hasn't closed it. Integer
+      # milliseconds keep Float arithmetic off the request path.
+      IDLE_CHECK_MS = 1000
+
+      # memcached's idle_timeout, a load balancer or a firewall can close a
+      # connection that sat unused. The next write still succeeds, into the
+      # kernel's buffer, and only the read fails, by which time the request
+      # counts as sent: one that isn't safe to send twice, such as an incr or
+      # an add, then raises instead of being retried. With no replies pending,
+      # an idle connection has nothing to read, so a readable one was closed
+      # by the other end (or holds bytes nothing asked for). Closing it here
+      # lets the request go out on a new connection. A connection dropped
+      # without the other end being told can't be detected this way.
+      def close_if_closed_by_peer!
+        return unless @sock.to_io.wait_readable(0)
+
+        Dalli.logger.debug { "#{name} closed the connection while it was idle; reconnecting" }
+        close
+      rescue IOError, SystemCallError
+        close
       end
 
       def confirm_in_progress!
@@ -176,12 +219,14 @@ module Dalli
         raise '[Dalli] Request already in progress. This may be a bug in Dalli.' if @request_in_progress
 
         @request_in_progress = true
+        @request_sent = false
       end
 
       def finish_request!
         raise '[Dalli] No request in progress. This may be a bug in Dalli.' unless @request_in_progress
 
         @request_in_progress = false
+        @request_sent = false
         # A completed request is what proves the server healthy again, so the
         # failure count resets here rather than on reconnect: a server that
         # accepts connections but never answers would otherwise reset it on
@@ -189,8 +234,26 @@ module Dalli
         @fail_count = 0
       end
 
+      # Ends a request whose reply isn't read with it: a quiet write, or one of
+      # set_multi's or delete_multi's writes. The server hasn't answered, so the
+      # failure count stays; the noop that reads the replies resets it.
+      def finish_unanswered_request!
+        raise '[Dalli] No request in progress. This may be a bug in Dalli.' unless @request_in_progress
+
+        @request_in_progress = false
+        @request_sent = false
+      end
+
       def abort_request!
         @request_in_progress = false
+        @request_sent = false
+      end
+
+      # True once any of the request in progress has been handed to the
+      # socket. Writes made outside a request (the version check on connect,
+      # draining an earlier quiet block's replies) don't count.
+      def request_sent?
+        @request_sent
       end
 
       # The longest reply line Dalli reads, in bytes, CRLF included. A meta
@@ -306,9 +369,11 @@ module Dalli
       end
 
       def reconnect!(message)
+        # Read before close, which ends the request
+        request_sent = @request_sent
         close
         sleep(options[:socket_failure_delay]) if options[:socket_failure_delay]
-        raise Dalli::RetryableNetworkError, message
+        raise Dalli::RetryableNetworkError.new(message, request_sent: request_sent)
       end
 
       # Called on connect. Deliberately leaves @fail_count alone; see
@@ -375,6 +440,8 @@ module Dalli
       def flush_write_buffer
         return if @write_buffer.empty?
 
+        # Set before writing: a write that fails may still have sent some bytes
+        @request_sent = true if @request_in_progress
         @sock.write(@write_buffer.size == 1 ? @write_buffer.first : joined_write_buffer)
         discard_write_buffer
       end
@@ -413,6 +480,43 @@ module Dalli
 
         raise EOFError, "EOF reading #{count} bytes; received #{buffer ? buffer.bytesize : 0}"
       end
+
+      # CRuby enforces socket_timeout on reads through IO#timeout=. TruffleRuby
+      # has no IO#timeout=, and JRuby (as of 10.1) defines it but doesn't
+      # enforce it; both ignore the SO_RCVTIMEO fallback, so a read from a
+      # server that stopped answering blocks forever. With
+      # enforce_read_timeout, the first read after a request is sent waits for
+      # the socket to be readable, up to socket_timeout. It's opt-in because
+      # the wait costs about 8% of single-key throughput on TruffleRuby and
+      # 20-29% on JRuby. A server that stops partway through a reply line can
+      # still block. So can one that stops partway through a value on
+      # TruffleRuby; JRuby reads values without blocking.
+      #
+      # TLS connections are left as they were: OpenSSL buffers decrypted
+      # bytes that wait_readable can't see.
+      module ReadTimeout
+        def read_line
+          flush_write_buffer
+          if @awaiting_reply
+            @awaiting_reply = false
+            wait_readable! unless @sock.is_a?(::OpenSSL::SSL::SSLSocket)
+          end
+          super
+        rescue SystemCallError, *TIMEOUT_ERRORS, *SSL_ERRORS, EOFError => e
+          error_on_request!(e)
+        end
+
+        private
+
+        def flush_write_buffer
+          @awaiting_reply = true unless @write_buffer.empty?
+          super
+        end
+
+        def wait_readable!
+          @sock.wait_readable(socket_timeout) or raise Timeout::Error, "IO timeout reading from #{name}"
+        end
+      end
     end
   end
 end

data/lib/dalli/protocol/key_regularizer.rb

@@ -44,9 +44,14 @@ module Dalli
           [key].pack('m0')
         end
 
+        # Decodes a key from a reply. One that isn't valid base64 means the
+        # reply is malformed, so it raises Dalli::DalliError like other bad
+        # replies, rather than unpack1's ArgumentError.
         def decode(encoded_key)
           strict_base64_decoded = encoded_key.unpack1('m0')
           strict_base64_decoded.force_encoding(Encoding::UTF_8)
+        rescue ArgumentError
+          raise Dalli::DalliError, "Reply key #{encoded_key.inspect} is marked base64 but isn't valid base64"
         end
       end
     end

data/lib/dalli/protocol/meta.rb

@@ -103,9 +103,14 @@ module Dalli
       #   - :hit_before - true/false if previously accessed (only if return_hit_status: true)
       #   - :last_access - seconds since last access (only if return_last_access: true)
       def meta_get(key, options = {})
+        # vivify_ttl is how long the stub lives, so like any TTL it must be
+        # sanitized: memcached reads a value over 30 days as a Unix timestamp.
+        # recache_ttl is a threshold compared with the remaining TTL, not an
+        # expiry, so it's sent as given.
+        vivify_ttl = options[:vivify_ttl] && TtlSanitizer.sanitize(options[:vivify_ttl])
         req = RequestFormatter.meta_get(
           key: key, value: true, return_cas: true, skip_flags: raw_request?(options),
-          vivify_ttl: options[:vivify_ttl], recache_ttl: options[:recache_ttl],
+          vivify_ttl: vivify_ttl, recache_ttl: options[:recache_ttl],
           return_hit_status: options[:return_hit_status],
           return_last_access: options[:return_last_access],
           return_ttl_remaining: options[:return_ttl_remaining],
@@ -157,7 +162,11 @@ module Dalli
 
       def write_storage_req(mode, key, raw_value, ttl = nil, cas = nil, options = {}, quiet: quiet?)
         (value, bitflags) = @value_marshaller.store(key, raw_value, options)
-        ttl = TtlSanitizer.sanitize(ttl) if ttl
+        # An Integer TTL of up to 30 days, the usual case, is left as it is by
+        # TtlSanitizer, so the call is skipped
+        ttl = TtlSanitizer.sanitize(ttl) unless ttl.nil? ||
+                                                (ttl.is_a?(Integer) &&
+                                                 ttl <= TtlSanitizer::MAX_ACCEPTABLE_EXPIRATION_INTERVAL)
         # eql?(0): only Integer 0 means "no CAS" here; anything else takes the general path
         req = if mode == :set && !quiet && (cas.nil? || cas.eql?(0)) && !routing_tokens?(options)
                 RequestFormatter.plain_meta_set(key, value.bytesize, bitflags, ttl)
@@ -167,7 +176,7 @@ module Dalli
                                           ttl: ttl, mode: mode, quiet: quiet,
                                           **routing_token_kwargs(options))
               end
-        write("#{req}#{value}#{TERMINATOR}")
+        write(request_with_value(req, value))
         finish_write(quiet)
       end
       # rubocop:enable Metrics/ParameterLists
@@ -188,10 +197,20 @@ module Dalli
         req = RequestFormatter.meta_set(key: key, value: value,
                                         cas: cas, ttl: ttl, mode: mode, quiet: quiet?,
                                         **routing_token_kwargs(options))
-        write("#{req}#{value}#{TERMINATOR}")
+        write(request_with_value(req, value))
         finish_write(quiet?)
       end
 
+      # Ruby refuses to join Strings whose encodings clash, such as a raw
+      # UTF-16 value, or a routing token with non-ASCII characters next to a
+      # binary value. memcached stores bytes, so join the bytes then. Joining
+      # the Strings first keeps the common case free of extra checks.
+      def request_with_value(req, value)
+        "#{req}#{value}#{TERMINATOR}"
+      rescue Encoding::CompatibilityError
+        "#{req.b}#{value.b}#{TERMINATOR}"
+      end
+
       # Delete Commands
       #
       # `options` supports the meta-delete keys :invalidate, :tombstone_ttl and
@@ -353,6 +372,7 @@ module Dalli
       def read_multi_metadata_responses(is_raw, keys)
         expect_reply_keys(keys)
         hash = {}
+        unmarshal_error = nil
         while (line = @connection_manager.read_line)
           break if line.start_with?('MN')
           next unless line.start_with?('VA ')
@@ -360,7 +380,7 @@ module Dalli
           tokens = line.chomp!(TERMINATOR).split
           size = tokens[1].to_i
           response_processor.check_value_size!(size)
-          value = @connection_manager.read(size + TERMINATOR.bytesize)&.chomp!(TERMINATOR)
+          value = response_processor.strip_value_terminator!(@connection_manager.read(size + TERMINATOR.bytesize))
           stale = response_processor.stale_from_tokens(tokens)
           cas = response_processor.cas_from_tokens(tokens)
           bitflags = is_raw ? 0 : response_processor.bitflags_from_tokens(tokens)
@@ -369,22 +389,39 @@ module Dalli
 
           raise_unexpected_reply_key(key) if unexpected_reply_key?(key)
 
-          hash[key] = { value: @value_marshaller.retrieve(value, bitflags), cas: cas, stale: stale, miss: false }
+          begin
+            hash[key] = { value: @value_marshaller.retrieve(value, bitflags), cas: cas, stale: stale, miss: false }
+          rescue Dalli::UnmarshalError => e
+            # Raised once the rest of the replies are read; see read_multi_get_responses
+            unmarshal_error ||= e
+          end
         end
+        raise unmarshal_error if unmarshal_error
+
         hash
       end
 
+      # A value that can't be deserialized raises Dalli::UnmarshalError, as
+      # get does, but only after the rest of the replies are read, so the
+      # connection is left in step. The first such error is raised.
       def read_multi_get_responses(is_raw, keys)
         expect_reply_keys(keys)
         hash = {}
+        unmarshal_error = nil
         while (line = @connection_manager.read_line)
           break if line.start_with?('MN')
           next unless line.start_with?('VA ')
 
-          key, value = parse_multi_get_value(line, is_raw)
-          raise_unexpected_reply_key(key) if unexpected_reply_key?(key)
+          begin
+            key, value = parse_multi_get_value(line, is_raw)
+          rescue Dalli::UnmarshalError => e
+            unmarshal_error ||= e
+            next
+          end
           hash[key] = value if key
         end
+        raise unmarshal_error if unmarshal_error
+
         hash
       end
 
@@ -401,10 +438,11 @@ module Dalli
         processor = response_processor
         size = processor.size_from_va_line(line)
         processor.check_value_size!(size)
-        value = @connection_manager.read(size + TERMINATOR.bytesize)&.chomp!(TERMINATOR)
+        value = processor.strip_value_terminator!(@connection_manager.read(size + TERMINATOR.bytesize))
         key = processor.key_from_va_line(line)
         return unless key
 
+        raise_unexpected_reply_key(key) if unexpected_reply_key?(key)
         bitflags = is_raw ? 0 : processor.bitflags_from_va_line(line)
         [key, @value_marshaller.retrieve(value, bitflags)]
       end

data/lib/dalli/protocol/request_formatter.rb

@@ -43,10 +43,10 @@ module Dalli
           # This saves 2 bytes per request and skips parsing on response.
           cmd << (skip_flags ? ' v' : ' v f') if value
           cmd << ' c' if return_cas
-          cmd << " T#{integer_flag(:ttl, ttl)}" if ttl
+          cmd << " T#{ttl_flag(:ttl, ttl)}" if ttl
           cmd << routing_tokens(p_token: p_token, l_token: l_token)
           cmd << ' k q s' if quiet # Return the key in the response if quiet
-          cmd << " N#{integer_flag(:vivify_ttl, vivify_ttl)}" if vivify_ttl # Thundering herd: vivify on miss
+          cmd << " N#{ttl_flag(:vivify_ttl, vivify_ttl)}" if vivify_ttl # Thundering herd: vivify on miss
           # Thundering herd: win recache if TTL below threshold
           cmd << " R#{integer_flag(:recache_ttl, recache_ttl)}" if recache_ttl
           cmd << ' h' if return_hit_status # Return hit status (0 or 1)
@@ -68,7 +68,7 @@ module Dalli
         # without the keyword-argument handling and incremental string building.
         def plain_meta_set(key, value_bytesize, bitflags, ttl)
           flags = bitflags ? " F#{bitflags}" : ''
-          flags += " T#{integer_flag(:ttl, ttl)}" if ttl
+          flags += " T#{ttl_flag(:ttl, ttl)}" if ttl
           if KeyRegularizer.required?(key)
             "ms #{KeyRegularizer.encode(key)} #{value_bytesize} c b#{flags} MS#{TERMINATOR}"
           else
@@ -111,7 +111,7 @@ module Dalli
           cmd << ' b' if base64
           cmd << " F#{bitflags}" if bitflags
           cmd << cas_string(cas)
-          cmd << " T#{integer_flag(:ttl, ttl)}" if ttl
+          cmd << " T#{ttl_flag(:ttl, ttl)}" if ttl
           cmd << " M#{mode_to_token(mode)}"
           cmd << ' q' if quiet
           cmd << routing_tokens(p_token: p_token, l_token: l_token)
@@ -120,9 +120,10 @@ module Dalli
 
         def multi_meta_set(entries, ttl: nil, p_token: nil, l_token: nil)
           # Routing tokens apply to every entry in the batch, so the suffix is
-          # built once rather than per entry.
-          token_suffix = routing_tokens(p_token: p_token, l_token: l_token)
-          ttl = integer_flag(:ttl, ttl) if ttl
+          # built once rather than per entry. It's binary, like the buffer, so
+          # a token with non-ASCII characters doesn't turn the buffer UTF-8.
+          token_suffix = routing_tokens(p_token: p_token, l_token: l_token).b
+          ttl = ttl_flag(:ttl, ttl) if ttl
 
           buffer = ''.b
           entries.each do |key, pair|
@@ -136,7 +137,9 @@ module Dalli
             buffer << ' b' if base64
             buffer << " F#{bitflags}" if bitflags
             buffer << " T#{ttl}" if ttl
-            buffer << ' MS q' << token_suffix << TERMINATOR << value << TERMINATOR
+            buffer << ' MS q' << token_suffix << TERMINATOR
+            append_bytes(buffer, value)
+            buffer << TERMINATOR
           end
           buffer << META_NOOP
         end
@@ -164,7 +167,7 @@ module Dalli
           cmd = "md #{encoded_key(key)}"
           cmd << cas_string(cas)
           cmd << ' I' if stale # Mark stale instead of deleting
-          cmd << " T#{integer_flag(:ttl, ttl)}" if ttl
+          cmd << " T#{ttl_flag(:ttl, ttl)}" if ttl
           cmd << ' x' if drop_value # Drop the value but keep the item
           cmd << ' q' if quiet
           cmd << routing_tokens(p_token: p_token, l_token: l_token)
@@ -183,7 +186,7 @@ module Dalli
 
           suffix = +''
           suffix << ' I' if stale
-          suffix << " T#{integer_flag(:ttl, ttl)}" if ttl
+          suffix << " T#{ttl_flag(:ttl, ttl)}" if ttl
           suffix << ' x' if drop_value
           suffix << ' q'
           suffix << routing_tokens(p_token: p_token, l_token: l_token)
@@ -199,10 +202,10 @@ module Dalli
         def meta_arithmetic(key:, delta:, initial:, incr: true, cas: nil, ttl: nil, quiet: false,
                             p_token: nil, l_token: nil)
           cmd = "ma #{encoded_key(key)} v"
-          cmd << " D#{integer_flag(:delta, delta)}" if delta
-          cmd << " J#{integer_flag(:initial, initial)}" if initial
+          cmd << " D#{parse_to_64_bit_int(:delta, delta)}" if delta
+          cmd << " J#{parse_to_64_bit_int(:initial, initial)}" if initial
           # Always set a TTL if an initial value is specified
-          cmd << " N#{ttl ? integer_flag(:ttl, ttl) : 0}" if ttl || initial
+          cmd << " N#{ttl ? ttl_flag(:ttl, ttl) : 0}" if ttl || initial
           cmd << cas_string(cas)
           cmd << ' q' if quiet
           cmd << " M#{incr ? 'I' : 'D'}"
@@ -254,7 +257,7 @@ module Dalli
 
         def flush(delay: nil, quiet: false)
           cmd = +'flush_all'
-          cmd << " #{parse_to_64_bit_int(delay, 0)}" if delay
+          cmd << " #{parse_to_64_bit_int(:delay, delay)}" if delay
           cmd << ' noreply' if quiet
           cmd << TERMINATOR
         end
@@ -279,6 +282,21 @@ module Dalli
 
         private
 
+        # Values are appended as bytes. One batch can hold UTF-8 and binary
+        # values, which String#<< refuses to combine, and a raw value can be in
+        # an encoding that isn't ASCII-compatible, such as UTF-16.
+        # Don't chain on the result: TruffleRuby's append_as_bytes returns its
+        # arguments rather than the buffer.
+        if String.method_defined?(:append_as_bytes)
+          def append_bytes(buffer, value)
+            buffer.append_as_bytes(value)
+          end
+        else
+          def append_bytes(buffer, value)
+            buffer << (value.encoding == Encoding::BINARY ? value : value.b)
+          end
+        end
+
         # Disallowed bytes: whitespace and control characters. CR, LF or NUL
         # would let a token inject a second command; a space would let it add
         # meta flags (T, N, I, q, ...) to the request it rides on.
@@ -304,6 +322,20 @@ module Dalli
           raise ArgumentError, "#{name} must be an Integer, got #{value.inspect}"
         end
 
+        # A TTL becomes memcached's expiration time, which must fit in a signed
+        # 32-bit value; anything else gets a CLIENT_ERROR reply, which a quiet
+        # request never reports. Callers pass TTLs through TtlSanitizer first.
+        def ttl_flag(name, value)
+          min = TtlSanitizer::MIN_EXPIRATION_TIME
+          max = TtlSanitizer::MAX_EXPIRATION_TIME
+          return value if value.is_a?(Integer) && value >= min && value <= max
+
+          ttl = integer_flag(name, value)
+          return ttl if ttl.between?(min, max)
+
+          raise ArgumentError, "#{name} must be between #{min} and #{max}, got #{value.inspect}"
+        end
+
         def mode_to_token(mode)
           case mode
           when :add
@@ -320,15 +352,31 @@ module Dalli
         end
 
         def cas_string(cas)
-          cas = parse_to_64_bit_int(cas, nil)
+          # No CAS, the usual case
+          return '' if cas.nil? || cas.eql?(0)
+
+          cas = parse_to_64_bit_int(:cas, cas)
           cas.nil? || cas.zero? ? '' : " C#{cas}"
         end
 
-        def parse_to_64_bit_int(val, default)
-          val.nil? ? nil : Integer(val)
-        rescue ArgumentError
-          # Sanitize to default if it isn't parsable as an integer
-          default
+        MAX_UINT64 = (2**64) - 1
+        private_constant :MAX_UINT64
+
+        # Parses a value memcached reads as an unsigned 64-bit integer (a CAS,
+        # an incr/decr delta or initial value, a flush delay): an Integer, or a
+        # String of decimal digits. Anything else raises. A bad CAS used to be
+        # dropped, which turned a CAS write into an unconditional one; a Float
+        # delta was truncated, so incr by 0.9 did nothing.
+        def parse_to_64_bit_int(name, val)
+          return nil if val.nil?
+
+          int = case val
+                when Integer then val
+                when String then Integer(val, 10, exception: false)
+                end
+          return int if int && int >= 0 && int <= MAX_UINT64
+
+          raise ArgumentError, "#{name} must be an Integer between 0 and #{MAX_UINT64}, got #{val.inspect}"
         end
       end
     end

data/lib/dalli/protocol/response_processor.rb

@@ -35,6 +35,8 @@ module Dalli
         BYTE_F = 'f'.ord
         BYTE_K = 'k'.ord
         BYTE_S = 's'.ord
+        BYTE_CR = "\r".ord
+        BYTE_LF = "\n".ord
 
         T_OK = [OK].freeze
         T_RESET = [RESET].freeze
@@ -280,16 +282,23 @@ module Dalli
           # a complete response, don't advance the buffer
           return [0] unless buf.bytesize >= offset + resp_size
 
-          # The full response is in our buffer, so parse it and return
-          # the values
-          body = buf.byteslice(offset + header_len, body_len)
-          value = retrieve(body, raw ? 0 : flag_int(bitflags, 'f'), raw)
+          # The CRLF after the value; see strip_value_terminator!
+          term = offset + header_len + body_len
+          raise_bad_value_terminator unless buf.getbyte(term) == BYTE_CR && buf.getbyte(term + 1) == BYTE_LF
+
           # A hit with no key can't be matched to a request: skip it (false
           # status) rather than yield it, or take it for the end of the pipeline
           return [false, resp_size] unless key
 
           key = key.delete_prefix!('k')
           key = KeyRegularizer.decode(key) if base64
+          # The full response is in our buffer, so parse it and return
+          # the values
+          begin
+            value = retrieve(buf.byteslice(offset + header_len, body_len), raw ? 0 : flag_int(bitflags, 'f'), raw)
+          rescue Dalli::UnmarshalError => e
+            return unmarshal_failed(e, key, resp_size)
+          end
           [tokens.first == VA, flag_int(cas, 'c'), key, value, resp_size]
         end
 
@@ -320,14 +329,37 @@ module Dalli
           resp_size = header_len + size + TERMINATOR.length
           return [0] unless buf.bytesize >= offset + resp_size
 
-          value = retrieve(buf.byteslice(offset + header_len, size), raw ? 0 : bitflags || 0, raw)
+          term = offset + header_len + size
+          raise_bad_value_terminator unless buf.getbyte(term) == BYTE_CR && buf.getbyte(term + 1) == BYTE_LF
+
           # Skipped like the token path does; see getk_response_from_buffer
           return [false, resp_size] unless key
 
           key = KeyRegularizer.decode(key) if base64
+          begin
+            value = retrieve(buf.byteslice(offset + header_len, size), raw ? 0 : bitflags || 0, raw)
+          rescue Dalli::UnmarshalError => e
+            return unmarshal_failed(e, key, resp_size)
+          end
           [true, cas || 0, key, value, resp_size]
         end
 
+        # A pipelined reply whose value can't be deserialized is consumed and
+        # skipped (false status), so the replies after it stay in step. Its
+        # key is still returned for the reply key check. The first such error
+        # is held until the pipeline finishes; see take_unmarshal_error.
+        def unmarshal_failed(error, key, resp_size)
+          @unmarshal_error ||= error
+          [false, 0, key, nil, resp_size]
+        end
+
+        # Returns the error held by unmarshal_failed, if any, and forgets it
+        def take_unmarshal_error
+          error = @unmarshal_error
+          @unmarshal_error = nil
+          error
+        end
+
         # Values from a raw request are returned as stored
         def retrieve(value, bitflags, raw)
           raw ? value : @value_marshaller.retrieve(value, bitflags)
@@ -461,6 +493,17 @@ module Dalli
           raise Dalli::DalliError, "Reply value size #{size} is out of range"
         end
 
+        # A value is read by its declared size, so check the CRLF that should
+        # follow it. If the size doesn't match the value, the rest of the
+        # reply would otherwise be read as the next one. Returns the value.
+        def strip_value_terminator!(data)
+          data&.chomp!(TERMINATOR) || raise_bad_value_terminator
+        end
+
+        def raise_bad_value_terminator
+          raise Dalli::DalliError, "Reply value isn't followed by CRLF, so its size doesn't match the value"
+        end
+
         def read_line
           @io_source.read_line&.chomp!(TERMINATOR)
         end
@@ -474,7 +517,7 @@ module Dalli
           # Checked before the terminator is added: -1 or -2 would otherwise
           # read 1 or 0 bytes and leave the connection out of step
           check_value_size!(data_size)
-          @io_source.read(data_size + TERMINATOR.bytesize)&.chomp!(TERMINATOR)
+          strip_value_terminator!(@io_source.read(data_size + TERMINATOR.bytesize))
         end
       end
     end

data/lib/dalli/protocol/ttl_sanitizer.rb

@@ -14,9 +14,17 @@ module Dalli
       #   treated as a unix timestamp of an exact date.
       MAX_ACCEPTABLE_EXPIRATION_INTERVAL = 30 * 24 * 60 * 60 # 30 days
 
+      # memcached holds an expiration time in a signed 32-bit integer, so a
+      # sanitized TTL outside this range is rejected with CLIENT_ERROR. A
+      # negative TTL is accepted and stores the item as already expired.
+      MIN_EXPIRATION_TIME = -(2**31)
+      MAX_EXPIRATION_TIME = (2**31) - 1
+
       # Ensures the TTL passed to Memcached is a valid TTL in the expected format.
+      # A String must be a whole number in decimal; it used to go through
+      # String#to_i, so 'abc' became 0, which means no expiry.
       def self.sanitize(ttl)
-        ttl_as_i = ttl.to_i
+        ttl_as_i = ttl.is_a?(String) ? Integer(ttl, 10) : ttl.to_i
         return ttl_as_i if less_than_max_expiration_interval?(ttl_as_i)
 
         as_timestamp(ttl_as_i)
@@ -30,9 +38,10 @@ module Dalli
         now = current_timestamp
         return ttl_as_i if ttl_as_i > now # Already a timestamp
 
-        Dalli.logger.debug "Expiration interval (#{ttl_as_i}) too long for Memcached " \
-                           'and too short to be a future timestamp, ' \
-                           'converting to an expiration timestamp'
+        Dalli.logger.debug do
+          "Expiration interval (#{ttl_as_i}) too long for Memcached " \
+            'and too short to be a future timestamp, converting to an expiration timestamp'
+        end
         now + ttl_as_i
       end
 

data/lib/dalli/ring.rb

@@ -34,6 +34,10 @@ module Dalli
       @failover = options[:failover] != false
     end
 
+    def failover?
+      @failover
+    end
+
     def continuum=(entries)
       @continuum = entries
       # Plain integers, so the lookup in server_for_hash_key needn't call