Fixed overflow detection in argument to long convertion function in general, and...

diff --git a/src/db.c b/src/db.c
index 0dec95b1c5763a8ecea00b2a469cebf14ce5ffb4..6d287d72c914762eef4ec17eb08a2f324df71e58 100644 (file)
--- a/src/db.c
+++ b/src/db.c
@@ -514,15 +514,14 @@ void expireatCommand(redisClient *c) {
 }
 
 void ttlCommand(redisClient *c) {
-    time_t expire;
-    int ttl = -1;
+    time_t expire, ttl = -1;
 
     expire = getExpire(c->db,c->argv[1]);
     if (expire != -1) {
-        ttl = (int) (expire-time(NULL));
+        ttl = (expire-time(NULL));
         if (ttl < 0) ttl = -1;
     }
-    addReplySds(c,sdscatprintf(sdsempty(),":%d\r\n",ttl));
+    addReplyLongLong(c,(long long)ttl);
 }
 
 void persistCommand(redisClient *c) {

diff --git a/src/object.c b/src/object.c
index 21268340c6d4e7e3b43766e5f405f51e5dfe8751..429ac0ecc6cd7eea9cabd7b987701dd9153278a0 100644 (file)
--- a/src/object.c
+++ b/src/object.c
@@ -358,6 +358,8 @@ int getLongLongFromObject(robj *o, long long *target) {
         if (o->encoding == REDIS_ENCODING_RAW) {
             value = strtoll(o->ptr, &eptr, 10);
             if (eptr[0] != '\0') return REDIS_ERR;
+            if (errno == ERANGE && (value == LLONG_MIN || value == LLONG_MAX))
+                return REDIS_ERR;
         } else if (o->encoding == REDIS_ENCODING_INT) {
             value = (long)o->ptr;
         } else {
@@ -375,7 +377,7 @@ int getLongLongFromObjectOrReply(redisClient *c, robj *o, long long *target, con
         if (msg != NULL) {
             addReplySds(c, sdscatprintf(sdsempty(), "-ERR %s\r\n", msg));
         } else {
-            addReplySds(c, sdsnew("-ERR value is not an integer\r\n"));
+            addReplySds(c, sdsnew("-ERR value is not an integer or out of range\r\n"));
         }
         return REDIS_ERR;
     }