X-Git-Url: https://git.m6w6.name/?a=blobdiff_plain;f=libmemcached%2Fstorage.c;h=deb4aed42ea82a718ff7d0df6c662a599432f0a0;hb=d2346aec8760237e77a5c2ff982159bae9ee4579;hp=25aaba303ead7fd0c367a84e1c049454e4b1f13b;hpb=3fca91c00a13fa7d6650bfe65aabf074fa5579b5;p=awesomized%2Flibmemcached

diff --git a/libmemcached/storage.c b/libmemcached/storage.c
index 25aaba30..deb4aed4 100644
--- a/libmemcached/storage.c
+++ b/libmemcached/storage.c
@@ -104,15 +104,24 @@ static inline memcached_return_t memcached_send(memcached_st *ptr,
 
     if (cas)
     {
-      write_length= (size_t) snprintf(buffer, MEMCACHED_DEFAULT_COMMAND_SIZE,
-                                      "%s %.*s%.*s %u %llu %zu %llu%s\r\n",
-                                      storage_op_string(verb),
-                                      (int)ptr->prefix_key_length,
-                                      ptr->prefix_key,
-                                      (int)key_length, key, flags,
-                                      (unsigned long long)expiration, value_length,
-                                      (unsigned long long)cas,
-                                      (ptr->flags.no_reply) ? " noreply" : "");
+      int check_length;
+      check_length= snprintf(buffer, MEMCACHED_DEFAULT_COMMAND_SIZE,
+                                    "%s %.*s%.*s %u %llu %lu %llu%s\r\n",
+                                    storage_op_string(verb),
+                                    (int)ptr->prefix_key_length,
+                                    ptr->prefix_key,
+                                    (int)key_length, key, flags,
+                                    (unsigned long long)expiration, (unsigned long)value_length,
+                                    (unsigned long long)cas,
+                                    (ptr->flags.no_reply) ? " noreply" : "");
+      if (check_length >= MEMCACHED_DEFAULT_COMMAND_SIZE || check_length < 0)
+      {
+        rc= MEMCACHED_WRITE_FAILURE;
+        memcached_io_reset(instance);
+
+        return rc;
+      }
+      write_length= check_length;
     }
     else
     {
@@ -133,11 +142,22 @@ static inline memcached_return_t memcached_send(memcached_st *ptr,
       buffer_ptr++;
 
       write_length= (size_t)(buffer_ptr - buffer);
-      write_length+= (size_t) snprintf(buffer_ptr, MEMCACHED_DEFAULT_COMMAND_SIZE,
-                                       "%u %llu %zu%s\r\n",
-                                       flags,
-                                       (unsigned long long)expiration, value_length,
-                                       ptr->flags.no_reply ? " noreply" : "");
+      int check_length;
+      check_length= snprintf(buffer_ptr, MEMCACHED_DEFAULT_COMMAND_SIZE -(size_t)(buffer_ptr - buffer),
+                                    "%u %llu %lu%s\r\n",
+                                    flags,
+                                    (unsigned long long)expiration, (unsigned long)value_length,
+                                    ptr->flags.no_reply ? " noreply" : "");
+      if ((size_t)check_length >= MEMCACHED_DEFAULT_COMMAND_SIZE -(size_t)(buffer_ptr - buffer) || check_length < 0)
+      {
+        rc= MEMCACHED_WRITE_FAILURE;
+        memcached_io_reset(instance);
+
+        return rc;
+      }
+
+      write_length+= (size_t)check_length;
+      WATCHPOINT_ASSERT(write_length < MEMCACHED_DEFAULT_COMMAND_SIZE);
     }
 
     if (ptr->flags.use_udp && ptr->flags.buffer_requests)