Skip to content

Commit 74d5235

Browse files
krokidustin
authored andcommitted
Fix heap corruption when copying too much data onto an item.
(Dustin:) I wrote a fuzz test that would consistently crash in assoc_find, but after this change the test failed to break things and my fuzz generator couldn't produce another breaking case.
1 parent 0ebdf6d commit 74d5235

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

memcached.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1527,7 +1527,7 @@ char *do_add_delta(item *it, const bool incr, const int64_t delta, char *buf) {
15271527
return "SERVER_ERROR out of memory in incr/decr";
15281528
}
15291529
memcpy(ITEM_data(new_it), buf, res);
1530-
memcpy(ITEM_data(new_it) + res, "\r\n", 3);
1530+
memcpy(ITEM_data(new_it) + res, "\r\n", 2);
15311531
do_item_replace(it, new_it);
15321532
do_item_remove(new_it); /* release our reference */
15331533
} else { /* replace in-place */

0 commit comments

Comments
 (0)