Skip to content

Commit 3727cfc

Browse files
committed
Return an error on increment/decrement larger than 32-bit unsigned
While the memcached protocol allows for 64-bit increments or decrements, the libmemcached API is limited to a 32-bit adjustment value. Protocol: https://github.com/memcached/memcached/blob/master/doc/protocol.txt#L274 API: http://docs.libmemcached.org/memcached_auto.html
1 parent 6ee6166 commit 3727cfc

File tree

3 files changed

+20
-6
lines changed

3 files changed

+20
-6
lines changed

php_memcached.c

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2185,7 +2185,8 @@ static void php_memc_deleteMulti_impl(INTERNAL_FUNCTION_PARAMETERS, zend_bool by
21852185
static void php_memc_incdec_impl(INTERNAL_FUNCTION_PARAMETERS, zend_bool by_key, zend_bool incr)
21862186
{
21872187
zend_string *key, *server_key = NULL;
2188-
long offset = 1;
2188+
zend_long offset = 1;
2189+
uint32_t offset32 = 0;
21892190
uint64_t value = UINT64_MAX, initial = 0;
21902191
time_t expiry = 0;
21912192
memcached_return status;
@@ -2208,7 +2209,12 @@ static void php_memc_incdec_impl(INTERNAL_FUNCTION_PARAMETERS, zend_bool by_key,
22082209
MEMC_CHECK_KEY(intern, key);
22092210

22102211
if (offset < 0) {
2211-
php_error_docref(NULL, E_WARNING, "offset has to be > 0");
2212+
php_error_docref(NULL, E_WARNING, "offset cannot be a negative value");
2213+
RETURN_FALSE;
2214+
}
2215+
2216+
if (offset > UINT_MAX) {
2217+
php_error_docref(NULL, E_WARNING, "offset cannot be larger than %d", UINT_MAX);
22122218
RETURN_FALSE;
22132219
}
22142220

tests/incrdecr.phpt

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,12 @@ var_dump($m->get('foo'));
3636
$m->decrement('foo', -1);
3737
echo $php_errormsg, "\n";
3838
var_dump($m->get('foo'));
39+
$m->increment('foo', 4294967295);
40+
echo $php_errormsg, "\n";
41+
var_dump($m->get('foo'));
42+
$m->decrement('foo', 4294967295);
43+
echo $php_errormsg, "\n";
44+
var_dump($m->get('foo'));
3945

4046
--EXPECT--
4147
Not there
@@ -52,7 +58,9 @@ int(4)
5258
int(3)
5359
int(1)
5460
Invalid offset
55-
Memcached::increment(): offset has to be > 0
61+
Memcached::increment(): offset cannot be negative
62+
int(1)
63+
Memcached::decrement(): offset cannot be negative
5664
int(1)
57-
Memcached::decrement(): offset has to be > 0
65+
Memcached::decrement(): offset cannot be larger than 2147483647
5866
int(1)

tests/incrdecr_bykey.phpt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ int(4)
4646
int(3)
4747
int(1)
4848
Invalid offset
49-
Memcached::incrementByKey(): offset has to be > 0
49+
Memcached::incrementByKey(): offset cannot be negative
5050
int(1)
51-
Memcached::decrementByKey(): offset has to be > 0
51+
Memcached::decrementByKey(): offset cannot be negative
5252
int(1)

0 commit comments

Comments
 (0)