diff options
| author | Oran Agra <oran@redislabs.com> | 2017-11-23 16:42:15 +0200 |
|---|---|---|
| committer | antirez <antirez@gmail.com> | 2017-11-24 09:00:37 +0100 |
| commit | d01f163ce0e60fe98d622d15e73de3c5a22396fc (patch) | |
| tree | be3e7cef201e7489276846ff5f199c39cc13cd8d /src/object.c | |
| parent | 9a3e15c6a2e00fda4f3edb9a99e6b903a60fc7de (diff) | |
| download | redis-d01f163ce0e60fe98d622d15e73de3c5a22396fc.tar.gz | |
fix string to double conversion, stopped parsing on \0 even if the string has more data.
getLongLongFromObject calls string2ll which has this line:
/* Return if not all bytes were used. */
so if you pass an sds with 3 characters "1\01" it will fail.
but getLongDoubleFromObject calls strtold, and considers it ok if eptr[0]==`\0`
i.e. if the end of the string found by strtold ends with null terminator
127.0.0.1:6379> set a 1
OK
127.0.0.1:6379> setrange a 2 2
(integer) 3
127.0.0.1:6379> get a
"1\x002"
127.0.0.1:6379> incrbyfloat a 2
"3"
127.0.0.1:6379> get a
"3"
Diffstat (limited to 'src/object.c')
| -rw-r--r-- | src/object.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/object.c b/src/object.c index d2db7963e..0950837c8 100644 --- a/src/object.c +++ b/src/object.c @@ -560,7 +560,7 @@ int getDoubleFromObject(const robj *o, double *target) { value = strtod(o->ptr, &eptr); if (sdslen(o->ptr) == 0 || isspace(((const char*)o->ptr)[0]) || - eptr[0] != '\0' || + (size_t)(eptr-(char*)o->ptr) != sdslen(o->ptr) || (errno == ERANGE && (value == HUGE_VAL || value == -HUGE_VAL || value == 0)) || isnan(value)) @@ -602,7 +602,7 @@ int getLongDoubleFromObject(robj *o, long double *target) { value = strtold(o->ptr, &eptr); if (sdslen(o->ptr) == 0 || isspace(((const char*)o->ptr)[0]) || - eptr[0] != '\0' || + (size_t)(eptr-(char*)o->ptr) != sdslen(o->ptr) || (errno == ERANGE && (value == HUGE_VAL || value == -HUGE_VAL || value == 0)) || isnan(value)) |