overflow detection in INCR family functions

[redis.git] / src / t_string.c

diff --git a/src/t_string.c b/src/t_string.c
index f1bab4dad358f533aef92ec97091fc38b6ba4b8c..c3e3607f305b5ee31ca76462047b6d5133d60d2c 100644 (file)
--- a/src/t_string.c
+++ b/src/t_string.c
@@ -195,11 +195,13 @@ void setrangeCommand(redisClient *c) {
     if (getLongFromObjectOrReply(c,c->argv[2],&offset,NULL) != REDIS_OK)
         return;
 
+    if (offset < 0) {
+        addReplyError(c,"offset is out of range");
+        return;
+    }
+
     o = lookupKeyWrite(c->db,c->argv[1]);
     if (o == NULL) {
-        /* Negative offset is always 0 for non-existing keys */
-        if (offset < 0) offset = 0;
-
         /* Return 0 when setting nothing on a non-existing string */
         if (sdslen(value) == 0) {
             addReply(c,shared.czero);
@@ -213,35 +215,19 @@ void setrangeCommand(redisClient *c) {
         o = createObject(REDIS_STRING,sdsempty());
         dbAdd(c->db,c->argv[1],o);
     } else {
-        int olen;
+        size_t olen;
 
         /* Key exists, check type */
         if (checkType(c,o,REDIS_STRING))
             return;
 
-        /* Find out existing value length */
-        if (o->encoding == REDIS_ENCODING_INT) {
-            char llbuf[32];
-            olen = ll2string(llbuf,sizeof(llbuf),(long)o->ptr);
-        } else {
-            olen = sdslen(o->ptr);
-        }
-
         /* Return existing string length when setting nothing */
+        olen = stringObjectLen(o);
         if (sdslen(value) == 0) {
             addReplyLongLong(c,olen);
             return;
         }
 
-        /* Convert negative indexes. Note that for SETRANGE, the meaning of a
-         * negative index is a little different than for other commands.
-         * Here, an offset of -1 points to the trailing NULL byte of the
-         * string instead of the last character. */
-        if (offset < 0) {
-            offset = olen+1+offset;
-            if (offset < 0) offset = 0;
-        }
-
         /* Return when the resulting string exceeds allowed size */
         if (checkStringLength(c,offset+sdslen(value)) != REDIS_OK)
             return;
@@ -360,14 +346,19 @@ void msetnxCommand(redisClient *c) {
 }
 
 void incrDecrCommand(redisClient *c, long long incr) {
-    long long value;
+    long long value, oldvalue;
     robj *o;
 
     o = lookupKeyWrite(c->db,c->argv[1]);
     if (o != NULL && checkType(c,o,REDIS_STRING)) return;
     if (getLongLongFromObjectOrReply(c,o,&value,NULL) != REDIS_OK) return;
 
+    oldvalue = value;
     value += incr;
+    if ((incr < 0 && value > oldvalue) || (incr > 0 && value < oldvalue)) {
+        addReplyError(c,"increment or decrement would overflow");
+        return;
+    }
     o = createStringObjectFromLongLong(value);
     dbReplace(c->db,c->argv[1],o);
     touchWatchedKey(c->db,c->argv[1]);
@@ -400,31 +391,26 @@ void decrbyCommand(redisClient *c) {
 }
 
 void appendCommand(redisClient *c) {
-    int retval;
     size_t totlen;
     robj *o, *append;
 
     o = lookupKeyWrite(c->db,c->argv[1]);
-    c->argv[2] = tryObjectEncoding(c->argv[2]);
     if (o == NULL) {
         /* Create the key */
-        retval = dbAdd(c->db,c->argv[1],c->argv[2]);
+        c->argv[2] = tryObjectEncoding(c->argv[2]);
+        dbAdd(c->db,c->argv[1],c->argv[2]);
         incrRefCount(c->argv[2]);
         totlen = stringObjectLen(c->argv[2]);
     } else {
-        if (o->type != REDIS_STRING) {
-            addReply(c,shared.wrongtypeerr);
+        /* Key exists, check type */
+        if (checkType(c,o,REDIS_STRING))
             return;
-        }
 
-        append = getDecodedObject(c->argv[2]);
-        if (o->encoding == REDIS_ENCODING_RAW &&
-            (sdslen(o->ptr) + sdslen(append->ptr)) > 512*1024*1024)
-        {
-            addReplyError(c,"string exceeds maximum allowed size (512MB)");
-            decrRefCount(append);
+        /* "append" is an argument, so always an sds */
+        append = c->argv[2];
+        totlen = stringObjectLen(o)+sdslen(append->ptr);
+        if (checkStringLength(c,totlen) != REDIS_OK)
             return;
-        }
 
         /* If the object is shared or encoded, we have to make a copy */
         if (o->refcount != 1 || o->encoding != REDIS_ENCODING_RAW) {
@@ -436,7 +422,6 @@ void appendCommand(redisClient *c) {
 
         /* Append the value */
         o->ptr = sdscatlen(o->ptr,append->ptr,sdslen(append->ptr));
-        decrRefCount(append);
         totlen = sdslen(o->ptr);
     }
     touchWatchedKey(c->db,c->argv[1]);
@@ -446,18 +431,8 @@ void appendCommand(redisClient *c) {
 
 void strlenCommand(redisClient *c) {
     robj *o;
-
     if ((o = lookupKeyReadOrReply(c,c->argv[1],shared.czero)) == NULL ||
         checkType(c,o,REDIS_STRING)) return;
-
-    if (o->encoding == REDIS_ENCODING_RAW) {
-        addReplyLongLong(c,sdslen(o->ptr));
-    } else if (o->encoding == REDIS_ENCODING_INT) {
-        char llbuf[32];
-        int len = ll2string(llbuf,sizeof(llbuf),(long)o->ptr);
-        addReplyLongLong(c,len);
-    } else {
-        redisPanic("Unknown string encoding");
-    }
+    addReplyLongLong(c,stringObjectLen(o));
 }