X-Git-Url: https://git.saurik.com/redis.git/blobdiff_plain/7b81e5a16ca577b7aa10dd0398cce4ba9cdf0842..60893c6cc6b08504d06aaa2e4eee5df29a479da1:/src/t_hash.c

diff --git a/src/t_hash.c b/src/t_hash.c
index 8ee5485c..f97fc992 100644
--- a/src/t_hash.c
+++ b/src/t_hash.c
@@ -320,7 +320,7 @@ void hmsetCommand(redisClient *c) {
 }
 
 void hincrbyCommand(redisClient *c) {
-    long long value, incr;
+    long long value, incr, oldvalue;
     robj *o, *current, *new;
 
     if (getLongLongFromObjectOrReply(c,c->argv[3],&incr,NULL) != REDIS_OK) return;
@@ -336,6 +336,12 @@ void hincrbyCommand(redisClient *c) {
         value = 0;
     }
 
+    oldvalue = value;
+    if ((incr < 0 && oldvalue < 0 && incr < (LLONG_MIN-oldvalue)) ||
+        (incr > 0 && oldvalue > 0 && incr > (LLONG_MAX-oldvalue))) {
+        addReplyError(c,"increment or decrement would overflow");
+        return;
+    }
     value += incr;
     new = createStringObjectFromLongLong(value);
     hashTypeTryObjectEncoding(o,&c->argv[2],NULL);