Commit 49c1c96f authored by Ozan Tezcan's avatar Ozan Tezcan Committed by Oran Agra
Browse files

Fix overflow check in expireGenericCommand

Partial cherry pick from #9601 in order for the tests in #9601 to pass

(cherry picked from commit b91d8b28)
parent d92f2f5a
...@@ -493,15 +493,23 @@ void expireGenericCommand(client *c, long long basetime, int unit) { ...@@ -493,15 +493,23 @@ void expireGenericCommand(client *c, long long basetime, int unit) {
if (getLongLongFromObjectOrReply(c, param, &when, NULL) != C_OK) if (getLongLongFromObjectOrReply(c, param, &when, NULL) != C_OK)
return; return;
int negative_when = when < 0;
if (unit == UNIT_SECONDS) when *= 1000; /* EXPIRE allows negative numbers, but we can at least detect an
when += basetime; * overflow by either unit conversion or basetime addition. */
if (((when < 0) && !negative_when) || ((when-basetime > 0) && negative_when)) { if (unit == UNIT_SECONDS) {
/* EXPIRE allows negative numbers, but we can at least detect an if (when > LLONG_MAX / 1000 || when < LLONG_MIN / 1000) {
* overflow by either unit conversion or basetime addition. */ addReplyErrorFormat(c, "invalid expire time in %s", c->cmd->name);
return;
}
when *= 1000;
}
if (when > LLONG_MAX - basetime) {
addReplyErrorFormat(c, "invalid expire time in %s", c->cmd->name); addReplyErrorFormat(c, "invalid expire time in %s", c->cmd->name);
return; return;
} }
when += basetime;
/* No key, return zero. */ /* No key, return zero. */
if (lookupKeyWrite(c->db,key) == NULL) { if (lookupKeyWrite(c->db,key) == NULL) {
addReply(c,shared.czero); addReply(c,shared.czero);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment