r5485 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r5484‎ | r5485 | r5486 >
Date:09:30, 25 September 2004
Author:midom
Status:old
Tags:
Comment:
fix stupid buffer size error.
Modified paths:
  • /trunk/tugelacache/dbcached.c (modified) (history)

Diff [purge]

Index: trunk/tugelacache/dbcached.c
@@ -541,7 +541,7 @@
542542 (strncmp(command, "decr ", 5) == 0)) {
543543 char temp[32];
544544 unsigned int value;
545 - item *it;
 545+ item *it, *newit = NULL, *putit = NULL;
546546 unsigned int delta;
547547 char key[251];
548548 int res, ret;
@@ -585,14 +585,25 @@
586586
587587 sprintf(temp, "%u", value);
588588 res = strlen(temp);
589 - memcpy(ITEM_data(it), temp, res);
590 - memset(ITEM_data(it) + res, ' ', it->nbytes - res - 2);
 589+ if (res + 2 > it->nbytes) {
 590+ newit =
 591+ item_alloc(ITEM_key(it), it->flags, it->exptime, res + 2);
 592+ memcpy(ITEM_data(newit), temp, res);
 593+ memcpy(ITEM_data(newit) + res, "\r\n", 2);
 594+ putit = newit;
 595+ } else {
 596+ memcpy(ITEM_data(it), temp, res);
 597+ memset(ITEM_data(it) + res, ' ', it->nbytes - res - 2);
 598+ putit = it;
 599+ }
591600 cleanup_dbt();
592601 dbkey.data = key;
593602 dbkey.size = strlen(key);
594 - dbdata.data = it;
595 - dbdata.size = ITEM_ntotal(it);
 603+ dbdata.data = putit;
 604+ dbdata.size = ITEM_ntotal(putit);
596605 dbp->put(dbp, NULL, &dbkey, &dbdata, NULL);
 606+ if (newit)
 607+ free(newit);
597608 out_string(c, temp);
598609 return;
599610 }

Status & tagging log