Fixed undefined behavior in *INCR style functions overflow detection. Sorry clang!

[redis.git] / src / t_hash.c

diff --git a/src/t_hash.c b/src/t_hash.c
index b8e2ad312d8508a8da332916e8c9b90b2f018ba8..f97fc9926a8078d9830268f8098b4ab925403bc9 100644 (file)
--- a/src/t_hash.c
+++ b/src/t_hash.c
@@ -337,11 +337,12 @@ void hincrbyCommand(redisClient *c) {
     }
 
     oldvalue = value;
     }
 
     oldvalue = value;

-    value += incr;
-    if ((incr < 0 && value > oldvalue) || (incr > 0 && value < oldvalue)) {
+    if ((incr < 0 && oldvalue < 0 && incr < (LLONG_MIN-oldvalue)) ||
+        (incr > 0 && oldvalue > 0 && incr > (LLONG_MAX-oldvalue))) {

         addReplyError(c,"increment or decrement would overflow");
         return;
     }
         addReplyError(c,"increment or decrement would overflow");
         return;
     }

+    value += incr;

     new = createStringObjectFromLongLong(value);
     hashTypeTryObjectEncoding(o,&c->argv[2],NULL);
     hashTypeSet(o,c->argv[2],new);
     new = createStringObjectFromLongLong(value);
     hashTypeTryObjectEncoding(o,&c->argv[2],NULL);
     hashTypeSet(o,c->argv[2],new);