diff options
| author | John Sully <john@csquare.ca> | 2019-03-14 14:02:16 -0400 |
|---|---|---|
| committer | antirez <antirez@gmail.com> | 2019-03-15 13:13:01 +0100 |
| commit | 9f13b2bd4967334b1701c6eccdf53760cb13f79e (patch) | |
| tree | 6a9ab4ab6c49f954f3cbfcc2bad6bc3ee8e535a1 /src/hyperloglog.c | |
| parent | 74d6af8f8094b6d9e2e4bb7ea4eca1941f6412c0 (diff) | |
| download | redis-9f13b2bd4967334b1701c6eccdf53760cb13f79e.tar.gz | |
Fix hyperloglog corruption
Diffstat (limited to 'src/hyperloglog.c')
| -rw-r--r-- | src/hyperloglog.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/src/hyperloglog.c b/src/hyperloglog.c index fc21ea006..e993bf26e 100644 --- a/src/hyperloglog.c +++ b/src/hyperloglog.c @@ -614,6 +614,10 @@ int hllSparseToDense(robj *o) { } else { runlen = HLL_SPARSE_VAL_LEN(p); regval = HLL_SPARSE_VAL_VALUE(p); + if ((runlen + idx) > HLL_REGISTERS) { + sdsfree(dense); + return C_ERR; + } while(runlen--) { HLL_DENSE_SET_REGISTER(hdr->registers,idx,regval); idx++; @@ -1088,6 +1092,8 @@ int hllMerge(uint8_t *max, robj *hll) { } else { runlen = HLL_SPARSE_VAL_LEN(p); regval = HLL_SPARSE_VAL_VALUE(p); + if ((runlen + i) > HLL_REGISTERS) + return C_ERR; while(runlen--) { if (regval > max[i]) max[i] = regval; i++; |