diff options
| author | yiyuaner <yiyuanguo96514@gmail.com> | 2022-03-22 16:46:16 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-03-22 10:46:16 +0200 |
| commit | 08aed7e7dd1c338e5fb69a10b8ae09a0ec11e96a (patch) | |
| tree | a1184c643dc93279dcfff570f025af17a6bbcb05 | |
| parent | 79db037a4f7bf18962f4255de84d1767d63da1f5 (diff) | |
| download | redis-08aed7e7dd1c338e5fb69a10b8ae09a0ec11e96a.tar.gz | |
Fix an off by one error in zzlStrtod (#10465)
When vlen = sizeof(buf), the statement buf[vlen] = '\0' accessing the buffer buf is an off by one error.
| -rw-r--r-- | src/t_zset.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/t_zset.c b/src/t_zset.c index dd0678f7a..3710b62d7 100644 --- a/src/t_zset.c +++ b/src/t_zset.c @@ -721,8 +721,8 @@ zskiplistNode *zslLastInLexRange(zskiplist *zsl, zlexrangespec *range) { double zzlStrtod(unsigned char *vstr, unsigned int vlen) { char buf[128]; - if (vlen > sizeof(buf)) - vlen = sizeof(buf); + if (vlen > sizeof(buf) - 1) + vlen = sizeof(buf) - 1; memcpy(buf,vstr,vlen); buf[vlen] = '\0'; return strtod(buf,NULL); |