From: dormando Date: Sat, 27 Apr 2019 01:17:57 -0700 Subject: fix segfault in "lru" command Origin: https://github.com/memcached/memcached/commit/d35334f368817a77a6bd1f33c6a5676b2c402c02 Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2019-11596 Bug-Debian: https://bugs.debian.org/928205 Bug: https://github.com/memcached/memcached/issues/474 fixes #474 - off by one in token count. --- memcached.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/memcached.c b/memcached.c index d64a83816ca6..7fd3e40e1155 100644 --- a/memcached.c +++ b/memcached.c @@ -4632,7 +4632,7 @@ static void process_lru_command(conn *c, token_t *tokens, const size_t ntokens) out_string(c, "OK"); } } - } else if (strcmp(tokens[1].value, "mode") == 0 && ntokens >= 3 && + } else if (strcmp(tokens[1].value, "mode") == 0 && ntokens >= 4 && settings.lru_maintainer_thread) { if (strcmp(tokens[2].value, "flat") == 0) { settings.lru_segmented = false; @@ -4643,7 +4643,7 @@ static void process_lru_command(conn *c, token_t *tokens, const size_t ntokens) } else { out_string(c, "ERROR"); } - } else if (strcmp(tokens[1].value, "temp_ttl") == 0 && ntokens >= 3 && + } else if (strcmp(tokens[1].value, "temp_ttl") == 0 && ntokens >= 4 && settings.lru_maintainer_thread) { if (!safe_strtol(tokens[2].value, &ttl)) { out_string(c, "ERROR"); -- 2.11.0