X-Git-Url: https://git.m6w6.name/?a=blobdiff_plain;f=libmemcached%2Fstats.c;h=ab005f49bb578a70e81fe0aead6e672a3fd12daf;hb=de994b897a87ccc8493f31c6b105fc37cfdc90a9;hp=0c52d97a6b4fbe8c9f1b6367dcca796b8b7c2a16;hpb=3fca91c00a13fa7d6650bfe65aabf074fa5579b5;p=awesomized%2Flibmemcached

diff --git a/libmemcached/stats.c b/libmemcached/stats.c
index 0c52d97a..ab005f49 100644
--- a/libmemcached/stats.c
+++ b/libmemcached/stats.c
@@ -227,6 +227,12 @@ char *memcached_stat_get_value(const memcached_st *ptr, memcached_stat_st *memc_
     return NULL;
   }
 
+  if (length >= SMALL_STRING_LEN || length < 0)
+  {
+    *error= MEMCACHED_FAILURE;
+    return NULL;
+  }
+
   ret= libmemcached_malloc(ptr, (size_t) (length + 1));
   memcpy(ret, buffer, (size_t) length);
   ret[length]= '\0';
@@ -329,7 +335,7 @@ static memcached_return_t ascii_stats_fetch(memcached_stat_st *memc_stat,
 {
   memcached_return_t rc;
   char buffer[MEMCACHED_DEFAULT_COMMAND_SIZE];
-  size_t send_length;
+  int send_length;
 
   if (args)
     send_length= (size_t) snprintf(buffer, MEMCACHED_DEFAULT_COMMAND_SIZE,
@@ -338,10 +344,10 @@ static memcached_return_t ascii_stats_fetch(memcached_stat_st *memc_stat,
     send_length= (size_t) snprintf(buffer, MEMCACHED_DEFAULT_COMMAND_SIZE,
                                    "stats\r\n");
 
-  if (send_length >= MEMCACHED_DEFAULT_COMMAND_SIZE)
+  if (send_length >= MEMCACHED_DEFAULT_COMMAND_SIZE || send_length < 0)
     return MEMCACHED_WRITE_FAILURE;
 
-  rc= memcached_do(instance, buffer, send_length, true);
+  rc= memcached_do(instance, buffer, (size_t)send_length, true);
   if (rc != MEMCACHED_SUCCESS)
     goto error;