root
/
redis
mirror of https://github.com/redis/redis.git
1
0
Fork 0
Code Issues Actions Packages Projects Releases Wiki Activity

Fix an off by one error in zzlStrtod (#10465) 

When vlen = sizeof(buf), the statement buf[vlen] = '\0' accessing the buffer buf is an off by one error.
This commit is contained in:
yiyuaner 2022-03-22 16:46:16 +08:00 committed by GitHub
parent 79db037a4f
commit 08aed7e7dd
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/t_zset.c
View File

@ -721,8 +721,8 @@ zskiplistNode *zslLastInLexRange(zskiplist *zsl, zlexrangespec *range) {
double zzlStrtod(unsigned char *vstr, unsigned int vlen) { double zzlStrtod(unsigned char *vstr, unsigned int vlen) {
char buf[128]; char buf[128];
if (vlen > sizeof(buf)) if (vlen > sizeof(buf) - 1)
vlen = sizeof(buf); vlen = sizeof(buf) - 1;
memcpy(buf,vstr,vlen); memcpy(buf,vstr,vlen);
buf[vlen] = '\0'; buf[vlen] = '\0';
return strtod(buf,NULL); return strtod(buf,NULL);