X-Git-Url: https://git.m6w6.name/?a=blobdiff_plain;f=libmemcached%2Fstats.c;h=ab005f49bb578a70e81fe0aead6e672a3fd12daf;hb=09355b181813d55d406f5346a4600811acd184fb;hp=731c1cc0a31bcad9d1bab3b8c64afa5eb3886d26;hpb=682a79f2cc82e31d37ca9db6bb5ec631c197d52c;p=awesomized%2Flibmemcached

diff --git a/libmemcached/stats.c b/libmemcached/stats.c
index 731c1cc0..ab005f49 100644
--- a/libmemcached/stats.c
+++ b/libmemcached/stats.c
@@ -227,6 +227,12 @@ char *memcached_stat_get_value(const memcached_st *ptr, memcached_stat_st *memc_
     return NULL;
   }
 
+  if (length >= SMALL_STRING_LEN || length < 0)
+  {
+    *error= MEMCACHED_FAILURE;
+    return NULL;
+  }
+
   ret= libmemcached_malloc(ptr, (size_t) (length + 1));
   memcpy(ret, buffer, (size_t) length);
   ret[length]= '\0';
@@ -258,11 +264,11 @@ static memcached_return_t binary_stats_fetch(memcached_stat_st *memc_stat,
     request.message.header.request.keylen= htons((uint16_t)len);
     request.message.header.request.bodylen= htonl((uint32_t) len);
 
-    struct __write_vector_st vector[]= 
+    struct libmemcached_io_vector_st vector[]=
     {
       { .length= sizeof(request.bytes), .buffer= request.bytes },
       { .length= len, .buffer= args }
-    }; 
+    };
 
     if (memcached_vdo(instance, vector, 2, true) != MEMCACHED_SUCCESS)
     {
@@ -302,7 +308,7 @@ static memcached_return_t binary_stats_fetch(memcached_stat_st *memc_stat,
         WATCHPOINT_ASSERT(0);
       }
     }
-    
+
     if (check && check->func)
     {
       size_t key_length= strlen(buffer);
@@ -329,7 +335,7 @@ static memcached_return_t ascii_stats_fetch(memcached_stat_st *memc_stat,
 {
   memcached_return_t rc;
   char buffer[MEMCACHED_DEFAULT_COMMAND_SIZE];
-  size_t send_length;
+  int send_length;
 
   if (args)
     send_length= (size_t) snprintf(buffer, MEMCACHED_DEFAULT_COMMAND_SIZE,
@@ -338,10 +344,10 @@ static memcached_return_t ascii_stats_fetch(memcached_stat_st *memc_stat,
     send_length= (size_t) snprintf(buffer, MEMCACHED_DEFAULT_COMMAND_SIZE,
                                    "stats\r\n");
 
-  if (send_length >= MEMCACHED_DEFAULT_COMMAND_SIZE)
+  if (send_length >= MEMCACHED_DEFAULT_COMMAND_SIZE || send_length < 0)
     return MEMCACHED_WRITE_FAILURE;
 
-  rc= memcached_do(instance, buffer, send_length, true);
+  rc= memcached_do(instance, buffer, (size_t)send_length, true);
   if (rc != MEMCACHED_SUCCESS)
     goto error;