mirrors
/
redis
mirror of https://mirror.osredm.com/root/redis.git
2
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

checks if the reply length exceeds available buffer space before calling _addReplyToBuffer

This commit is contained in:
fcostaoliveira 2024-11-14 01:02:21 +00:00
parent 048bfe4eda
commit 03e8ff3af7
1 changed files with 5 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/networking.c
View File

@ -323,9 +323,7 @@ int prepareClientToWrite(client *c) {
* zmalloc_usable_size() call. Writing beyond client->buf boundaries confuses * zmalloc_usable_size() call. Writing beyond client->buf boundaries confuses
* sanitizer and generates a false positive out-of-bounds error */ * sanitizer and generates a false positive out-of-bounds error */
REDIS_NO_SANITIZE("bounds") REDIS_NO_SANITIZE("bounds")
static inline void _addReplyToBuffer(client *c, const char *s, size_t len) { static inline void _addReplyToBuffer(client *c, const char *s, size_t reply_len) {
const size_t available = c->buf_usable_size - c->bufpos;
const size_t reply_len = len > available ? available : len;
memcpy(c->buf+c->bufpos,s,reply_len); memcpy(c->buf+c->bufpos,s,reply_len);
c->bufpos+=reply_len; c->bufpos+=reply_len;
/* We update the buffer peak after appending the reply to the buffer */ /* We update the buffer peak after appending the reply to the buffer */
@ -411,9 +409,10 @@ void _addReplyToBufferOrList(client *c, const char *s, size_t len) {
return; return;
} }
/* If there already are entries in the reply list, we cannot /* If there already are entries in the reply list or the added length surpasses the buffer,
* add anything more to the static buffer. */ * we cannot add anything more to the static buffer. */
if (listLength(c->reply) > 0) const int out_buffer_boundary = len > (c->buf_usable_size - c->bufpos);
if (listLength(c->reply) > 0 || out_buffer_boundary)
_addReplyProtoToList(c,c->reply,s,len); _addReplyProtoToList(c,c->reply,s,len);
else else
_addReplyToBuffer(c,s,len); _addReplyToBuffer(c,s,len);