提交 7c96b467 编写于 作者: A antirez

Fixed undefined behavior in *INCR style functions overflow detection. Sorry clang!

上级 fe7be460
...@@ -337,11 +337,12 @@ void hincrbyCommand(redisClient *c) { ...@@ -337,11 +337,12 @@ void hincrbyCommand(redisClient *c) {
} }
oldvalue = value; oldvalue = value;
value += incr; if ((incr < 0 && oldvalue < 0 && incr < (LLONG_MIN-oldvalue)) ||
if ((incr < 0 && value > oldvalue) || (incr > 0 && value < oldvalue)) { (incr > 0 && oldvalue > 0 && incr > (LLONG_MAX-oldvalue))) {
addReplyError(c,"increment or decrement would overflow"); addReplyError(c,"increment or decrement would overflow");
return; return;
} }
value += incr;
new = createStringObjectFromLongLong(value); new = createStringObjectFromLongLong(value);
hashTypeTryObjectEncoding(o,&c->argv[2],NULL); hashTypeTryObjectEncoding(o,&c->argv[2],NULL);
hashTypeSet(o,c->argv[2],new); hashTypeSet(o,c->argv[2],new);
......
...@@ -344,11 +344,12 @@ void incrDecrCommand(redisClient *c, long long incr) { ...@@ -344,11 +344,12 @@ void incrDecrCommand(redisClient *c, long long incr) {
if (getLongLongFromObjectOrReply(c,o,&value,NULL) != REDIS_OK) return; if (getLongLongFromObjectOrReply(c,o,&value,NULL) != REDIS_OK) return;
oldvalue = value; oldvalue = value;
value += incr; if ((incr < 0 && oldvalue < 0 && incr < (LLONG_MIN-oldvalue)) ||
if ((incr < 0 && value > oldvalue) || (incr > 0 && value < oldvalue)) { (incr > 0 && oldvalue > 0 && incr > (LLONG_MAX-oldvalue))) {
addReplyError(c,"increment or decrement would overflow"); addReplyError(c,"increment or decrement would overflow");
return; return;
} }
value += incr;
new = createStringObjectFromLongLong(value); new = createStringObjectFromLongLong(value);
if (o) if (o)
dbOverwrite(c->db,c->argv[1],new); dbOverwrite(c->db,c->argv[1],new);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册