Fix hyperloglog corruption

7f79849c · John Sully · antirez · 3ef2c831 · 7f79849c
隐藏空白更改
内联并排

Showing with 6 addition and 0 deletion

src/hyperloglog.c src/hyperloglog.c +6 -0

未找到文件。
--- a/src/hyperloglog.c
+++ b/src/hyperloglog.c
@@ -614,6 +614,10 @@ int hllSparseToDense(robj *o) {
        } else {
            runlen = HLL_SPARSE_VAL_LEN(p);
            regval = HLL_SPARSE_VAL_VALUE(p);
+            if ((runlen + idx) > HLL_REGISTERS) {
+                sdsfree(dense);
+                return C_ERR;
+            }
            while(runlen--) {
                HLL_DENSE_SET_REGISTER(hdr->registers,idx,regval);
                idx++;
@@ -1088,6 +1092,8 @@ int hllMerge(uint8_t *max, robj *hll) {
            } else {
                runlen = HLL_SPARSE_VAL_LEN(p);
                regval = HLL_SPARSE_VAL_VALUE(p);
+                if ((runlen + i) > HLL_REGISTERS)
+                    return C_ERR;
                while(runlen--) {
                    if (regval > max[i]) max[i] = regval;
                    i++;