overflow detection in INCR family functions

[redis.git] / src / t_string.c

diff --git a/src/t_string.c b/src/t_string.c
index e50692183ec40fd1d62ee4f82fa9333140e82fe8..c3e3607f305b5ee31ca76462047b6d5133d60d2c 100644 (file)
--- a/src/t_string.c
+++ b/src/t_string.c
@@ -215,21 +215,14 @@ void setrangeCommand(redisClient *c) {
         o = createObject(REDIS_STRING,sdsempty());
         dbAdd(c->db,c->argv[1],o);
     } else {
-        int olen;
+        size_t olen;
 
         /* Key exists, check type */
         if (checkType(c,o,REDIS_STRING))
             return;
 
-        /* Find out existing value length */
-        if (o->encoding == REDIS_ENCODING_INT) {
-            char llbuf[32];
-            olen = ll2string(llbuf,sizeof(llbuf),(long)o->ptr);
-        } else {
-            olen = sdslen(o->ptr);
-        }
-
         /* Return existing string length when setting nothing */
+        olen = stringObjectLen(o);
         if (sdslen(value) == 0) {
             addReplyLongLong(c,olen);
             return;
@@ -353,14 +346,19 @@ void msetnxCommand(redisClient *c) {
 }
 
 void incrDecrCommand(redisClient *c, long long incr) {
-    long long value;
+    long long value, oldvalue;
     robj *o;
 
     o = lookupKeyWrite(c->db,c->argv[1]);
     if (o != NULL && checkType(c,o,REDIS_STRING)) return;
     if (getLongLongFromObjectOrReply(c,o,&value,NULL) != REDIS_OK) return;
 
+    oldvalue = value;
     value += incr;
+    if ((incr < 0 && value > oldvalue) || (incr > 0 && value < oldvalue)) {
+        addReplyError(c,"increment or decrement would overflow");
+        return;
+    }
     o = createStringObjectFromLongLong(value);
     dbReplace(c->db,c->argv[1],o);
     touchWatchedKey(c->db,c->argv[1]);
@@ -433,18 +431,8 @@ void appendCommand(redisClient *c) {
 
 void strlenCommand(redisClient *c) {
     robj *o;
-
     if ((o = lookupKeyReadOrReply(c,c->argv[1],shared.czero)) == NULL ||
         checkType(c,o,REDIS_STRING)) return;
-
-    if (o->encoding == REDIS_ENCODING_RAW) {
-        addReplyLongLong(c,sdslen(o->ptr));
-    } else if (o->encoding == REDIS_ENCODING_INT) {
-        char llbuf[32];
-        int len = ll2string(llbuf,sizeof(llbuf),(long)o->ptr);
-        addReplyLongLong(c,len);
-    } else {
-        redisPanic("Unknown string encoding");
-    }
+    addReplyLongLong(c,stringObjectLen(o));
 }