Unverified Commit 08aed7e7 authored by yiyuaner's avatar yiyuaner Committed by GitHub
Browse files

Fix an off by one error in zzlStrtod (#10465)

When vlen = sizeof(buf), the statement buf[vlen] = '\0' accessing the buffer buf is an off by one error.
parent 79db037a
...@@ -721,8 +721,8 @@ zskiplistNode *zslLastInLexRange(zskiplist *zsl, zlexrangespec *range) { ...@@ -721,8 +721,8 @@ zskiplistNode *zslLastInLexRange(zskiplist *zsl, zlexrangespec *range) {
double zzlStrtod(unsigned char *vstr, unsigned int vlen) { double zzlStrtod(unsigned char *vstr, unsigned int vlen) {
char buf[128]; char buf[128];
if (vlen > sizeof(buf)) if (vlen > sizeof(buf) - 1)
vlen = sizeof(buf); vlen = sizeof(buf) - 1;
memcpy(buf,vstr,vlen); memcpy(buf,vstr,vlen);
buf[vlen] = '\0'; buf[vlen] = '\0';
return strtod(buf,NULL); return strtod(buf,NULL);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment