diff options
author | antirez <antirez@gmail.com> | 2014-04-13 10:19:12 +0200 |
---|---|---|
committer | antirez <antirez@gmail.com> | 2014-04-16 15:09:46 +0200 |
commit | 68fb3019a09dddbc0e1f6c43a113e4a85addb7a0 (patch) | |
tree | 7f02928616a8d828af3b767c4bc1bae07956f9b0 | |
parent | e7e6aa49d036e79aa47c42d9a86cf4c12ff5b6c6 (diff) | |
download | redis-68fb3019a09dddbc0e1f6c43a113e4a85addb7a0.tar.gz |
hllSparseAdd() sanity check for span != 0 added.
-rw-r--r-- | src/hyperloglog.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/hyperloglog.c b/src/hyperloglog.c index 5a19443b4..b3235e1fb 100644 --- a/src/hyperloglog.c +++ b/src/hyperloglog.c @@ -612,6 +612,7 @@ sds hllSparseToDense(sds sparse) { * * On success, the function returns 1 if the cardinality changed, or 0 * if the register for this element was not updated. + * On error (if the representation is invalid) -1 is returned. * * As a side effect the function may promote the HLL representation from * sparse to dense: this happens when a register requires to be set to a value @@ -645,6 +646,7 @@ int hllSparseAdd(robj *o, unsigned char *ele, size_t elesize) { first = 0; prev = NULL; /* Points to previos opcode at the end of the loop. */ next = NULL; /* Points to the next opcode at the end of the loop. */ + span = 0; while(p < end) { /* Set span to the number of registers covered by this opcode. */ if (HLL_SPARSE_IS_ZERO(p)) span = HLL_SPARSE_ZERO_LEN(p); @@ -656,6 +658,7 @@ int hllSparseAdd(robj *o, unsigned char *ele, size_t elesize) { p += (HLL_SPARSE_IS_XZERO(p)) ? 2 : 1; first += span; } + if (span == 0) return -1; /* Invalid format. */ next = HLL_SPARSE_IS_XZERO(p) ? p+2 : p+1; if (next >= end) next = NULL; |