fluencelabs/redis
1
0
Fork 0
mirror of https://github.com/fluencelabs/redis synced 2025-03-30 22:31:03 +00:00
Code Issues Projects Releases Wiki Activity

Fixed undefined behavior in *INCR style functions overflow detection. Sorry clang!

Browse Source
This commit is contained in:
antirez 2012-02-21 18:25:49 +01:00
parent fe7be46025
commit 7c96b467c1
2 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/t_hash.c
View File

@ -337,11 +337,12 @@ void hincrbyCommand(redisClient *c) {
} }
oldvalue = value; oldvalue = value;
value += incr; if ((incr < 0 && oldvalue < 0 && incr < (LLONG_MIN-oldvalue)) ||
if ((incr < 0 && value > oldvalue) || (incr > 0 && value < oldvalue)) { (incr > 0 && oldvalue > 0 && incr > (LLONG_MAX-oldvalue))) {
addReplyError(c,"increment or decrement would overflow"); addReplyError(c,"increment or decrement would overflow");
return; return;
} }
value += incr;
new = createStringObjectFromLongLong(value); new = createStringObjectFromLongLong(value);
hashTypeTryObjectEncoding(o,&c->argv[2],NULL); hashTypeTryObjectEncoding(o,&c->argv[2],NULL);
hashTypeSet(o,c->argv[2],new); hashTypeSet(o,c->argv[2],new);

5
src/t_string.c
View File

@ -344,11 +344,12 @@ void incrDecrCommand(redisClient *c, long long incr) {
if (getLongLongFromObjectOrReply(c,o,&value,NULL) != REDIS_OK) return; if (getLongLongFromObjectOrReply(c,o,&value,NULL) != REDIS_OK) return;
oldvalue = value; oldvalue = value;
value += incr; if ((incr < 0 && oldvalue < 0 && incr < (LLONG_MIN-oldvalue)) ||
if ((incr < 0 && value > oldvalue) || (incr > 0 && value < oldvalue)) { (incr > 0 && oldvalue > 0 && incr > (LLONG_MAX-oldvalue))) {
addReplyError(c,"increment or decrement would overflow"); addReplyError(c,"increment or decrement would overflow");
return; return;
} }
value += incr;
new = createStringObjectFromLongLong(value); new = createStringObjectFromLongLong(value);
if (o) if (o)
dbOverwrite(c->db,c->argv[1],new); dbOverwrite(c->db,c->argv[1],new);