提交 be86082b 编写于 作者: A antirez

Fixed a theoretical non exploitable security bug reported by @chrisrohlf. In...

Fixed a theoretical non exploitable security bug reported by @chrisrohlf. In theory if we undefine SDS_ABORT_ON_OOM from sds.c AND modify zmalloc.c in order to don't quit on out of memory (but this would break every other part of Redis), on out of memory there is a possible heap overflow.
上级 cc9f0eee
......@@ -305,7 +305,10 @@ sds *sdssplitlen(char *s, int len, char *sep, int seplen, int *count) {
#ifdef SDS_ABORT_ON_OOM
if (tokens == NULL) sdsOomAbort();
#endif
if (seplen < 1 || len < 0 || tokens == NULL) return NULL;
if (seplen < 1 || len < 0 || tokens == NULL) {
*count = 0;
return NULL;
}
if (len == 0) {
*count = 0;
return tokens;
......@@ -360,6 +363,7 @@ cleanup:
int i;
for (i = 0; i < elements; i++) sdsfree(tokens[i]);
zfree(tokens);
*count = 0;
return NULL;
}
#endif
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册