search

nicolasff / webdis

A Redis HTTP interface with JSON output
https://webd.is
BSD 2-Clause "Simplified" License
2.82k stars 307 forks source link

Potential integer overflow in sds.c #245

Open the-Chain-Warden-thresh opened 5 months ago

the-Chain-Warden-thresh commented 5 months ago

The sdsnewlen and sdsMakeRoomFor function implemented in sds.c is quite similiar to those in the redis. Thus, it's very likely that this integer overflow in CVE-2021-21309 also affects webdis. Here is the patch for CVE-2021-21309 for your reference if this issue needs to be fixed.