From: antirez <antirez@gmail.com>
Date: Thu, 22 Nov 2012 14:28:28 +0000 (+0100)
Subject: Fix integer overflow in zunionInterGenericCommand().
X-Git-Url: https://git.saurik.com/redis.git/commitdiff_plain/cceb0c5b4a24d9027abfc47924d5f93af87034b4?ds=inline;hp=-c

Fix integer overflow in zunionInterGenericCommand().

This fixes issue #761.
---

cceb0c5b4a24d9027abfc47924d5f93af87034b4
diff --git a/src/t_zset.c b/src/t_zset.c
index f641d887..f5cdec3e 100644
--- a/src/t_zset.c
+++ b/src/t_zset.c
@@ -1497,7 +1497,7 @@ void zunionInterGenericCommand(redisClient *c, robj *dstkey, int op) {
     }
 
     /* test if the expected number of keys would overflow */
-    if (3+setnum > c->argc) {
+    if (setnum > c->argc-3) {
         addReply(c,shared.syntaxerr);
         return;
     }