diff options
author | antirez <antirez@gmail.com> | 2012-02-21 18:25:49 +0100 |
---|---|---|
committer | antirez <antirez@gmail.com> | 2012-02-21 18:26:11 +0100 |
commit | 7c96b467c1f882874f80403101ec96ddaf624f1a (patch) | |
tree | 6153b695136ed266fd3ed4b5a7d9d6d2ccb11250 /src/t_string.c | |
parent | fe7be460257627848987d7bf6d80ce8540b01628 (diff) | |
download | redis-7c96b467c1f882874f80403101ec96ddaf624f1a.tar.gz |
Fixed undefined behavior in *INCR style functions overflow detection. Sorry clang!
Diffstat (limited to 'src/t_string.c')
-rw-r--r-- | src/t_string.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/src/t_string.c b/src/t_string.c index 2bd1646e3..d6143ed27 100644 --- a/src/t_string.c +++ b/src/t_string.c @@ -344,11 +344,12 @@ void incrDecrCommand(redisClient *c, long long incr) { if (getLongLongFromObjectOrReply(c,o,&value,NULL) != REDIS_OK) return; oldvalue = value; - value += incr; - if ((incr < 0 && value > oldvalue) || (incr > 0 && value < oldvalue)) { + if ((incr < 0 && oldvalue < 0 && incr < (LLONG_MIN-oldvalue)) || + (incr > 0 && oldvalue > 0 && incr > (LLONG_MAX-oldvalue))) { addReplyError(c,"increment or decrement would overflow"); return; } + value += incr; new = createStringObjectFromLongLong(value); if (o) dbOverwrite(c->db,c->argv[1],new); |