@@ -90,6 +90,7 @@ sds sdsnewlen(const void *init, size_t initlen) {
90
90
int hdrlen = sdsHdrSize (type );
91
91
unsigned char * fp ; /* flags pointer. */
92
92
93
+ if (hdrlen + initlen + 1 <= initlen ) return NULL ; /* Catch size_t overflow */
93
94
sh = s_malloc (hdrlen + initlen + 1 );
94
95
if (sh == NULL ) return NULL ;
95
96
if (!init )
@@ -174,7 +175,7 @@ void sdsfree(sds s) {
174
175
* the output will be "6" as the string was modified but the logical length
175
176
* remains 6 bytes. */
176
177
void sdsupdatelen (sds s ) {
177
- int reallen = strlen (s );
178
+ size_t reallen = strlen (s );
178
179
sdssetlen (s , reallen );
179
180
}
180
181
@@ -196,7 +197,7 @@ void sdsclear(sds s) {
196
197
sds sdsMakeRoomFor (sds s , size_t addlen ) {
197
198
void * sh , * newsh ;
198
199
size_t avail = sdsavail (s );
199
- size_t len , newlen ;
200
+ size_t len , newlen , reqlen ;
200
201
char type , oldtype = s [-1 ] & SDS_TYPE_MASK ;
201
202
int hdrlen ;
202
203
@@ -205,7 +206,8 @@ sds sdsMakeRoomFor(sds s, size_t addlen) {
205
206
206
207
len = sdslen (s );
207
208
sh = (char * )s - sdsHdrSize (oldtype );
208
- newlen = (len + addlen );
209
+ reqlen = newlen = (len + addlen );
210
+ if (newlen <= len ) return NULL ; /* Catch size_t overflow */
209
211
if (newlen < SDS_MAX_PREALLOC )
210
212
newlen *= 2 ;
211
213
else
@@ -219,6 +221,7 @@ sds sdsMakeRoomFor(sds s, size_t addlen) {
219
221
if (type == SDS_TYPE_5 ) type = SDS_TYPE_8 ;
220
222
221
223
hdrlen = sdsHdrSize (type );
224
+ if (hdrlen + newlen + 1 <= reqlen ) return NULL ; /* Catch size_t overflow */
222
225
if (oldtype == type ) {
223
226
newsh = s_realloc (sh , hdrlen + newlen + 1 );
224
227
if (newsh == NULL ) return NULL ;
@@ -580,7 +583,7 @@ sds sdscatprintf(sds s, const char *fmt, ...) {
580
583
*/
581
584
sds sdscatfmt (sds s , char const * fmt , ...) {
582
585
const char * f = fmt ;
583
- int i ;
586
+ long i ;
584
587
va_list ap ;
585
588
586
589
va_start (ap ,fmt );
@@ -755,14 +758,14 @@ int sdsrange(sds s, ssize_t start, ssize_t end) {
755
758
756
759
/* Apply tolower() to every character of the sds string 's'. */
757
760
void sdstolower (sds s ) {
758
- int len = sdslen (s ), j ;
761
+ size_t len = sdslen (s ), j ;
759
762
760
763
for (j = 0 ; j < len ; j ++ ) s [j ] = tolower (s [j ]);
761
764
}
762
765
763
766
/* Apply toupper() to every character of the sds string 's'. */
764
767
void sdstoupper (sds s ) {
765
- int len = sdslen (s ), j ;
768
+ size_t len = sdslen (s ), j ;
766
769
767
770
for (j = 0 ; j < len ; j ++ ) s [j ] = toupper (s [j ]);
768
771
}
0 commit comments