Potential fault at createDoubleObject

[afcidk]

The potential fault occurs at the parameter len of createDoubleObject.

From the function prototype, we can see that len is of size_t type, which is known as an unsigned integer.

hiredis/hiredis.c

Line 221 in b6f86f3

static void *createDoubleObject(const redisReadTask *task, double value, char *str, size_t len) {

This function attempts to allocate some space for string-typed double value dval, and allocates one more byte for the null-terminating character for the string.

hiredis/hiredis.c

Lines 228 to 233 in b6f86f3

	r->dval = value;
	r->str = hi_malloc(len+1);
	if (r->str == NULL) {
	freeReplyObject(r);
	return NULL;
	}

When len is -1, the program allocates a space with size 0 for r->str.
According to man 3 malloc,

If size is 0, then malloc() returns either NULL, or a unique pointer value that can later be successfully passed to free().

If hi_malloc does not return NULL, the program will crash in the following memcpy, which passes maximum value of unsigned integer to the size of memcpy.

hiredis/hiredis.c

Line 240 in b6f86f3

memcpy(r->str, str, len);

Additional check to len parameter should be included in createDoubleObject function.

[kristjanvalur]

Why would you want to specify len as -1 (it is unsigned). Or do you mean to say that the largest possible len value causes a crash? Wouldn't it simply be better to specify the behaviour as undefined if len + 1 does not fit within a size_t ?