root
/
redis
mirror of https://github.com/redis/redis.git
1
0
Fork 0
Code Issues Actions Packages Projects Releases Wiki Activity

Fix overflow check in expireGenericCommand 

Partial cherry pick from #9601 in order for the tests in #9601 to pass

(cherry picked from commit b91d8b289b)
This commit is contained in:
Ozan Tezcan 2021-11-11 14:51:33 +03:00 committed by Oran Agra
parent d92f2f5ad6
commit 49c1c96fc1
1 changed files with 14 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/expire.c
View File

@ -493,15 +493,23 @@ void expireGenericCommand(client *c, long long basetime, int unit) {
if (getLongLongFromObjectOrReply(c, param, &when, NULL) != C_OK) if (getLongLongFromObjectOrReply(c, param, &when, NULL) != C_OK)
return; return;
int negative_when = when < 0;
if (unit == UNIT_SECONDS) when *= 1000;
when += basetime;
if (((when < 0) && !negative_when) || ((when-basetime > 0) && negative_when)) {
/* EXPIRE allows negative numbers, but we can at least detect an /* EXPIRE allows negative numbers, but we can at least detect an
* overflow by either unit conversion or basetime addition. */ * overflow by either unit conversion or basetime addition. */
if (unit == UNIT_SECONDS) {
if (when > LLONG_MAX / 1000 || when < LLONG_MIN / 1000) {
addReplyErrorFormat(c, "invalid expire time in %s", c->cmd->name); addReplyErrorFormat(c, "invalid expire time in %s", c->cmd->name);
return; return;
} }
when *= 1000;
}
if (when > LLONG_MAX - basetime) {
addReplyErrorFormat(c, "invalid expire time in %s", c->cmd->name);
return;
}
when += basetime;
/* No key, return zero. */ /* No key, return zero. */
if (lookupKeyWrite(c->db,key) == NULL) { if (lookupKeyWrite(c->db,key) == NULL) {
addReply(c,shared.czero); addReply(c,shared.czero);