Skip to content

Commit 6553f4d

Browse files
odaysecranshid
authored andcommitted
Fix unsigned difference expression compared to zero (valkey-io#2101)
https://github.com/valkey-io/valkey/blob/daea05b1e26db29bfd1c033e27f9d519a2f8ccbb/src/networking.c#L886-L886 Fix the issue need to ensure that the subtraction `prev->size - prev->used` does not underflow. This can be achieved by explicitly checking that `prev->used` is less than `prev->size` before performing the subtraction. This approach avoids relying on unsigned arithmetic and ensures the logic is clear and robust. The specific changes are: 1. Replace the condition `prev->size - prev->used > 0` with `prev->used < prev->size`. 2. This change ensures that the logic checks whether there is remaining space in the buffer without risking underflow. **References** [INT02-C. Understand integer conversion rules](https://wiki.sei.cmu.edu/confluence/display/c/INT02-C.+Understand+integer+conversion+rules) [CWE-191](https://cwe.mitre.org/data/definitions/191.html) --- Signed-off-by: Zeroday BYTE <github@zerodaysec.org>
1 parent 137f3f7 commit 6553f4d

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

src/networking.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -859,7 +859,7 @@ void setDeferredReply(client *c, void *node, const char *s, size_t length) {
859859
* - It has enough room already allocated
860860
* - And not too large (avoid large memmove)
861861
* - And the client is not in a pending I/O state */
862-
if (ln->prev != NULL && (prev = listNodeValue(ln->prev)) && prev->size - prev->used > 0 &&
862+
if (ln->prev != NULL && (prev = listNodeValue(ln->prev)) && prev->used < prev->size &&
863863
c->io_write_state != CLIENT_PENDING_IO) {
864864
size_t len_to_copy = prev->size - prev->used;
865865
if (len_to_copy > length) len_to_copy = length;

0 commit comments

Comments
 (0)