From bc8d837b72aa226ac1b0c4e112ad08ed8da6d0d3 Mon Sep 17 00:00:00 2001 From: zhangtaoXT5 <50564994+zhangtaoXT5@users.noreply.github.com> Date: Fri, 2 Sep 2022 04:45:28 +0800 Subject: [PATCH] fix heap-buffer-overflow (#957) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Prevent incrementing passed a `\0` in our format string. Co-authored-by: Michael Grunder Co-authored-by: Kristján Valur Jónsson --- hiredis.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/hiredis.c b/hiredis.c index c0968ed..a3b3edd 100644 --- a/hiredis.c +++ b/hiredis.c @@ -485,6 +485,8 @@ int redisvFormatCommand(char **target, const char *format, va_list ap) { touched = 1; c++; + if (*c == '\0') + break; } c++; }