summaryrefslogtreecommitdiff
path: root/CVE-2019-10193.patch
blob: 80edfd3f15856652b576064860ae78180163d409 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
From 4c7eda965af7f231148219267c9b039d06cab519 Mon Sep 17 00:00:00 2001
From: antirez <antirez@gmail.com>
Date: Fri, 15 Mar 2019 17:10:16 +0100
Subject: [PATCH] HyperLogLog: enlarge reghisto variable for safety.

---
 src/hyperloglog.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/hyperloglog.c b/src/hyperloglog.c
index 68d591c..24cf81a 100644
--- a/src/hyperloglog.c
+++ b/src/hyperloglog.c
@@ -1011,7 +1011,12 @@ uint64_t hllCount(struct hllhdr *hdr, int *invalid) {
     double E;
     int j;
     double alphaInf = 0.5 / log(2.);
-    int reghisto[HLL_Q+2] = {0};    
+    /* Note that reghisto could be just HLL_Q+1, becuase this is the
+     * maximum frequency of the "000...1" sequence the hash function is
+     * able to return. However it is slow to check for sanity of the
+     * input: instead we history array at a safe size: overflows will
+     * just write data to wrong, but correctly allocated, places. */
+    int reghisto[64] = {0};
 
     /* Compute register histogram */
     if (hdr->encoding == HLL_DENSE) {
-- 
2.23.0