From: Brian Aker <brian@tangent.org>
Date: Sun, 27 Jan 2008 22:22:09 +0000 (-0800)
Subject: Kevin's patch bug13
X-Git-Tag: 0.15~4
X-Git-Url: https://git.m6w6.name/?a=commitdiff_plain;h=69b905e54a2f5ad5038a3f75c269bbbb4c3e610f;p=m6w6%2Flibmemcached

Kevin's patch bug13
---

diff --git a/lib/memcached_io.c b/lib/memcached_io.c
index 9e63fe73..22c54e42 100644
--- a/lib/memcached_io.c
+++ b/lib/memcached_io.c
@@ -162,8 +162,10 @@ ssize_t memcached_io_write(memcached_server_st *ptr,
                            char *buffer, size_t length, char with_flush)
 {
   size_t original_length;
+  char* buffer_ptr;
 
   original_length= length;
+  buffer_ptr= buffer;
 
   while (length)
   {
@@ -175,8 +177,9 @@ ssize_t memcached_io_write(memcached_server_st *ptr,
 
     should_write= (should_write < length) ? should_write : length;
 
-    memcpy(write_ptr, buffer, should_write);
+    memcpy(write_ptr, buffer_ptr, should_write);
     ptr->write_buffer_offset+= should_write;
+    buffer_ptr+= should_write;
     length-= should_write;
 
     if (ptr->write_buffer_offset == MEMCACHED_MAX_BUFFER)
diff --git a/tests/function.c b/tests/function.c
index b2bcd4ad..13c09ad1 100644
--- a/tests/function.c
+++ b/tests/function.c
@@ -1147,7 +1147,10 @@ uint8_t user_supplied_bug2(memcached_st *memc)
       if (rc == MEMCACHED_NOTFOUND)
         errors++;
       else
+      {
+        WATCHPOINT_ERROR(rc);
         assert(0);
+      }
 
       continue;
     }
@@ -1643,6 +1646,41 @@ uint8_t user_supplied_bug12(memcached_st *memc)
   return 0;
 }
 
+/*
+  Bug found where command total one more than MEMCACHED_MAX_BUFFER
+  set key34567890 0 0 8169 \r\n is sent followed by buffer of size 8169, followed by 8169
+ */
+uint8_t user_supplied_bug13(memcached_st *memc)
+{
+  char key[] = "key34567890";
+  char *overflow;
+  memcached_return rc;
+  size_t overflowSize;
+
+  char commandFirst[]= "set key34567890 0 0 ";
+  char commandLast[] = " \r\n"; /* first line of command sent to server */
+  size_t commandLength;
+  size_t testSize;
+
+  commandLength = strlen(commandFirst) + strlen(commandLast) + 4; /* 4 is number of characters in size, probably 8196 */
+
+  overflowSize = MEMCACHED_MAX_BUFFER - commandLength;
+
+  for (testSize= overflowSize - 1; testSize < overflowSize + 1; testSize++)
+  {
+    overflow= malloc(testSize);
+    assert(overflow != NULL);
+
+    memset(overflow, 'x', testSize);
+    rc= memcached_set(memc, key, strlen(key),
+                      overflow, testSize, 0, 0);
+    assert(rc == MEMCACHED_SUCCESS);
+    free(overflow);
+  }
+
+  return 0;
+}
+
 uint8_t result_static(memcached_st *memc)
 {
   memcached_result_st result;
@@ -2281,6 +2319,7 @@ test_st user_tests[] ={
   {"user_supplied_bug10", 1, user_supplied_bug10 },
   {"user_supplied_bug11", 1, user_supplied_bug11 },
   {"user_supplied_bug12", 1, user_supplied_bug12 },
+  {"user_supplied_bug13", 1, user_supplied_bug13 },
   {0, 0, 0}
 };