Fix integer overflow in zunionInterGenericCommand().

This fixes issue #761.

diff --git a/src/t_zset.c b/src/t_zset.c
index f641d887cf4107b8cebe8d14b94df46642dd9dd8..f5cdec3e4bce2c55c2140941372b951f1526f051 100644 (file)
--- a/src/t_zset.c
+++ b/src/t_zset.c
@@ -1497,7 +1497,7 @@ void zunionInterGenericCommand(redisClient *c, robj *dstkey, int op) {
     }
 
     /* test if the expected number of keys would overflow */
-    if (3+setnum > c->argc) {
+    if (setnum > c->argc-3) {
         addReply(c,shared.syntaxerr);
         return;
     }