Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
redis
Commits
2b0ac742
Commit
2b0ac742
authored
Sep 29, 2021
by
YiyuanGUO
Committed by
Oran Agra
Oct 04, 2021
Browse files
Fix integer overflow in _sdsMakeRoomFor (CVE-2021-41099)
parent
021af762
Changes
1
Hide whitespace changes
Inline
Side-by-side
src/sds.c
View file @
2b0ac742
...
...
@@ -205,7 +205,7 @@ void sdsclear(sds s) {
sds
sdsMakeRoomFor
(
sds
s
,
size_t
addlen
)
{
void
*
sh
,
*
newsh
;
size_t
avail
=
sdsavail
(
s
);
size_t
len
,
newlen
;
size_t
len
,
newlen
,
reqlen
;
char
type
,
oldtype
=
s
[
-
1
]
&
SDS_TYPE_MASK
;
int
hdrlen
;
...
...
@@ -214,7 +214,7 @@ sds sdsMakeRoomFor(sds s, size_t addlen) {
len
=
sdslen
(
s
);
sh
=
(
char
*
)
s
-
sdsHdrSize
(
oldtype
);
newlen
=
(
len
+
addlen
);
reqlen
=
newlen
=
(
len
+
addlen
);
assert
(
newlen
>
len
);
/* Catch size_t overflow */
if
(
newlen
<
SDS_MAX_PREALLOC
)
newlen
*=
2
;
...
...
@@ -229,7 +229,7 @@ sds sdsMakeRoomFor(sds s, size_t addlen) {
if
(
type
==
SDS_TYPE_5
)
type
=
SDS_TYPE_8
;
hdrlen
=
sdsHdrSize
(
type
);
assert
(
hdrlen
+
newlen
+
1
>
len
);
/* Catch size_t overflow */
assert
(
hdrlen
+
newlen
+
1
>
req
len
);
/* Catch size_t overflow */
if
(
oldtype
==
type
)
{
newsh
=
s_realloc
(
sh
,
hdrlen
+
newlen
+
1
);
if
(
newsh
==
NULL
)
return
NULL
;
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment