提交 c91abdcd 编写于 作者: A antirez

Fixed overflow detection in argument to long convertion function in general,...

Fixed overflow detection in argument to long convertion function in general, and in expire/ttl pairs specifically, addressing issue 54
上级 cbce5171
...@@ -514,15 +514,14 @@ void expireatCommand(redisClient *c) { ...@@ -514,15 +514,14 @@ void expireatCommand(redisClient *c) {
} }
void ttlCommand(redisClient *c) { void ttlCommand(redisClient *c) {
time_t expire; time_t expire, ttl = -1;
int ttl = -1;
expire = getExpire(c->db,c->argv[1]); expire = getExpire(c->db,c->argv[1]);
if (expire != -1) { if (expire != -1) {
ttl = (int) (expire-time(NULL)); ttl = (expire-time(NULL));
if (ttl < 0) ttl = -1; if (ttl < 0) ttl = -1;
} }
addReplySds(c,sdscatprintf(sdsempty(),":%d\r\n",ttl)); addReplyLongLong(c,(long long)ttl);
} }
void persistCommand(redisClient *c) { void persistCommand(redisClient *c) {
......
...@@ -358,6 +358,8 @@ int getLongLongFromObject(robj *o, long long *target) { ...@@ -358,6 +358,8 @@ int getLongLongFromObject(robj *o, long long *target) {
if (o->encoding == REDIS_ENCODING_RAW) { if (o->encoding == REDIS_ENCODING_RAW) {
value = strtoll(o->ptr, &eptr, 10); value = strtoll(o->ptr, &eptr, 10);
if (eptr[0] != '\0') return REDIS_ERR; if (eptr[0] != '\0') return REDIS_ERR;
if (errno == ERANGE && (value == LLONG_MIN || value == LLONG_MAX))
return REDIS_ERR;
} else if (o->encoding == REDIS_ENCODING_INT) { } else if (o->encoding == REDIS_ENCODING_INT) {
value = (long)o->ptr; value = (long)o->ptr;
} else { } else {
...@@ -375,7 +377,7 @@ int getLongLongFromObjectOrReply(redisClient *c, robj *o, long long *target, con ...@@ -375,7 +377,7 @@ int getLongLongFromObjectOrReply(redisClient *c, robj *o, long long *target, con
if (msg != NULL) { if (msg != NULL) {
addReplySds(c, sdscatprintf(sdsempty(), "-ERR %s\r\n", msg)); addReplySds(c, sdscatprintf(sdsempty(), "-ERR %s\r\n", msg));
} else { } else {
addReplySds(c, sdsnew("-ERR value is not an integer\r\n")); addReplySds(c, sdsnew("-ERR value is not an integer or out of range\r\n"));
} }
return REDIS_ERR; return REDIS_ERR;
} }
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册