Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
redis
Commits
dadc67a9
"vscode:/vscode.git/clone" did not exist on "93c1d31d97a995cd07a2c235b7a4e177f3c752cc"
Commit
dadc67a9
authored
Sep 29, 2021
by
YiyuanGUO
Committed by
Oran Agra
Oct 04, 2021
Browse files
Fix integer overflow in _sdsMakeRoomFor (CVE-2021-41099)
parent
2775a352
Changes
1
Hide whitespace changes
Inline
Side-by-side
src/sds.c
View file @
dadc67a9
...
@@ -233,7 +233,7 @@ void sdsclear(sds s) {
...
@@ -233,7 +233,7 @@ void sdsclear(sds s) {
sds
sdsMakeRoomFor
(
sds
s
,
size_t
addlen
)
{
sds
sdsMakeRoomFor
(
sds
s
,
size_t
addlen
)
{
void
*
sh
,
*
newsh
;
void
*
sh
,
*
newsh
;
size_t
avail
=
sdsavail
(
s
);
size_t
avail
=
sdsavail
(
s
);
size_t
len
,
newlen
;
size_t
len
,
newlen
,
reqlen
;
char
type
,
oldtype
=
s
[
-
1
]
&
SDS_TYPE_MASK
;
char
type
,
oldtype
=
s
[
-
1
]
&
SDS_TYPE_MASK
;
int
hdrlen
;
int
hdrlen
;
size_t
usable
;
size_t
usable
;
...
@@ -243,7 +243,7 @@ sds sdsMakeRoomFor(sds s, size_t addlen) {
...
@@ -243,7 +243,7 @@ sds sdsMakeRoomFor(sds s, size_t addlen) {
len
=
sdslen
(
s
);
len
=
sdslen
(
s
);
sh
=
(
char
*
)
s
-
sdsHdrSize
(
oldtype
);
sh
=
(
char
*
)
s
-
sdsHdrSize
(
oldtype
);
newlen
=
(
len
+
addlen
);
reqlen
=
newlen
=
(
len
+
addlen
);
assert
(
newlen
>
len
);
/* Catch size_t overflow */
assert
(
newlen
>
len
);
/* Catch size_t overflow */
if
(
newlen
<
SDS_MAX_PREALLOC
)
if
(
newlen
<
SDS_MAX_PREALLOC
)
newlen
*=
2
;
newlen
*=
2
;
...
@@ -258,7 +258,7 @@ sds sdsMakeRoomFor(sds s, size_t addlen) {
...
@@ -258,7 +258,7 @@ sds sdsMakeRoomFor(sds s, size_t addlen) {
if
(
type
==
SDS_TYPE_5
)
type
=
SDS_TYPE_8
;
if
(
type
==
SDS_TYPE_5
)
type
=
SDS_TYPE_8
;
hdrlen
=
sdsHdrSize
(
type
);
hdrlen
=
sdsHdrSize
(
type
);
assert
(
hdrlen
+
newlen
+
1
>
len
);
/* Catch size_t overflow */
assert
(
hdrlen
+
newlen
+
1
>
req
len
);
/* Catch size_t overflow */
if
(
oldtype
==
type
)
{
if
(
oldtype
==
type
)
{
newsh
=
s_realloc_usable
(
sh
,
hdrlen
+
newlen
+
1
,
&
usable
);
newsh
=
s_realloc_usable
(
sh
,
hdrlen
+
newlen
+
1
,
&
usable
);
if
(
newsh
==
NULL
)
return
NULL
;
if
(
newsh
==
NULL
)
return
NULL
;
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment