1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
|
From: dormando <dormando@rydia.net>
Date: Sat, 27 Apr 2019 01:17:57 -0700
Subject: fix segfault in "lru" command
Origin: https://github.com/memcached/memcached/commit/d35334f368817a77a6bd1f33c6a5676b2c402c02
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2019-11596
Bug-Debian: https://bugs.debian.org/928205
Bug: https://github.com/memcached/memcached/issues/474
fixes #474 - off by one in token count.
---
memcached.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/memcached.c b/memcached.c
index d64a83816ca6..7fd3e40e1155 100644
--- a/memcached.c
+++ b/memcached.c
@@ -4632,7 +4632,7 @@ static void process_lru_command(conn *c, token_t *tokens, const size_t ntokens)
out_string(c, "OK");
}
}
- } else if (strcmp(tokens[1].value, "mode") == 0 && ntokens >= 3 &&
+ } else if (strcmp(tokens[1].value, "mode") == 0 && ntokens >= 4 &&
settings.lru_maintainer_thread) {
if (strcmp(tokens[2].value, "flat") == 0) {
settings.lru_segmented = false;
@@ -4643,7 +4643,7 @@ static void process_lru_command(conn *c, token_t *tokens, const size_t ntokens)
} else {
out_string(c, "ERROR");
}
- } else if (strcmp(tokens[1].value, "temp_ttl") == 0 && ntokens >= 3 &&
+ } else if (strcmp(tokens[1].value, "temp_ttl") == 0 && ntokens >= 4 &&
settings.lru_maintainer_thread) {
if (!safe_strtol(tokens[2].value, &ttl)) {
out_string(c, "ERROR");
--
2.11.0
|
