Fix hyperloglog corruption

2019-03-18 11:25:27 +01:00
parent 3ef2c8316e
commit 7f79849caa
1 changed files with 6 additions and 0 deletions
@@ -614,6 +614,10 @@ int hllSparseToDense(robj *o) {
        } else {
            runlen = HLL_SPARSE_VAL_LEN(p);
            regval = HLL_SPARSE_VAL_VALUE(p);
+            if ((runlen + idx) > HLL_REGISTERS) {
+                sdsfree(dense);
+                return C_ERR;
+            }
            while(runlen--) {
                HLL_DENSE_SET_REGISTER(hdr->registers,idx,regval);
                idx++;
@@ -1088,6 +1092,8 @@ int hllMerge(uint8_t *max, robj *hll) {
            } else {
                runlen = HLL_SPARSE_VAL_LEN(p);
                regval = HLL_SPARSE_VAL_VALUE(p);
+                if ((runlen + i) > HLL_REGISTERS)
+                    return C_ERR;
                while(runlen--) {
                    if (regval > max[i]) max[i] = regval;
                    i++;