From: Pieter Noordhuis <pcnoordhuis@gmail.com>
Date: Wed, 27 Apr 2011 12:32:56 +0000 (+0200)
Subject: Check seplen and len before malloc'ing "tokens"
X-Git-Url: https://git.saurik.com/redis.git/commitdiff_plain/c040cbd6252b493456ca910d7b1d1cf4122959d4?ds=inline

Check seplen and len before malloc'ing "tokens"
---

diff --git a/src/sds.c b/src/sds.c
index 343ad1fa..63507000 100644
--- a/src/sds.c
+++ b/src/sds.c
@@ -298,15 +298,17 @@ int sdscmp(sds s1, sds s2) {
  */
 sds *sdssplitlen(char *s, int len, char *sep, int seplen, int *count) {
     int elements = 0, slots = 5, start = 0, j;
+    sds *tokens;
 
-    sds *tokens = zmalloc(sizeof(sds)*slots);
+    if (seplen < 1 || len < 0) return NULL;
+
+    tokens = zmalloc(sizeof(sds)*slots);
 #ifdef SDS_ABORT_ON_OOM
     if (tokens == NULL) sdsOomAbort();
+#else
+    if (tokens == NULL) return NULL;
 #endif
-    if (seplen < 1 || len < 0 || tokens == NULL) {
-        *count = 0;
-        return NULL;
-    }
+
     if (len == 0) {
         *count = 0;
         return tokens;