Skip to content

Commit

Permalink
BITCOUNT: fix segmentation fault.
Browse files Browse the repository at this point in the history
remove unsafe and unnecessary cast.
until now, this cast may lead segmentation fault when end > UINT_MAX

setbit foo 0 1
bitcount  0 4294967295
=> ok
bitcount  0 4294967296
=> cause segmentation fault.

Note by @antirez: the commit was modified a bit to also change the
string length type to long, since it's guaranteed to be at max 512 MB in
size, so we can work with the same type across all the code path.

A regression test was also added.
  • Loading branch information
trapezoid authored and antirez committed Sep 5, 2012
1 parent 24bc807 commit 749aac7
Show file tree
Hide file tree
Showing 2 changed files with 8 additions and 3 deletions.
5 changes: 2 additions & 3 deletions src/bitops.c
Original file line number Diff line number Diff line change
Expand Up @@ -327,10 +327,9 @@ void bitopCommand(redisClient *c) {
/* BITCOUNT key [start end] */
void bitcountCommand(redisClient *c) {
robj *o;
long start, end;
long start, end, strlen;
unsigned char *p;
char llbuf[32];
size_t strlen;

/* Lookup, check for type, and return 0 for non existing keys. */
if ((o = lookupKeyReadOrReply(c,c->argv[1],shared.czero)) == NULL ||
Expand All @@ -357,7 +356,7 @@ void bitcountCommand(redisClient *c) {
if (end < 0) end = strlen+end;
if (start < 0) start = 0;
if (end < 0) end = 0;
if ((unsigned)end >= strlen) end = strlen-1;
if (end >= strlen) end = strlen-1;
} else if (c->argc == 2) {
/* The whole string. */
start = 0;
Expand Down
6 changes: 6 additions & 0 deletions tests/unit/bitops.tcl
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,12 @@ start_server {tags {"bitops"}} {
set e
} {ERR*syntax*}

test {BITCOUNT regression test for github issue #582} {
r del str
r setbit foo 0 1
r bitcount foo 0 4294967296
} {1}

test {BITOP NOT (empty string)} {
r set s ""
r bitop not dest s
Expand Down

0 comments on commit 749aac7

Please sign in to comment.