From 427627f17bcea2b4d208baf213c67e6e54fe381a Mon Sep 17 00:00:00 2001
From: tlnguyen <tlnguyen@smu.edu.sg>
Date: Thu, 18 Dec 2025 19:43:28 +0800
Subject: [PATCH] Fix integer overflow in _sdsMakeRoomFor (CVE-2021-41099)

---
 rmutil/sds.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/rmutil/sds.c b/rmutil/sds.c
index e3dd673..00c98dd 100644
--- a/rmutil/sds.c
+++ b/rmutil/sds.c
@@ -194,7 +194,7 @@ void sdsclear(sds s) {
 sds sdsMakeRoomFor(sds s, size_t addlen) {
     void *sh, *newsh;
     size_t avail = sdsavail(s);
-    size_t len, newlen;
+    size_t len, newlen, reqlen;
     char type, oldtype = s[-1] & SDS_TYPE_MASK;
     int hdrlen;
 
@@ -203,7 +203,7 @@ sds sdsMakeRoomFor(sds s, size_t addlen) {
 
     len = sdslen(s);
     sh = (char*)s-sdsHdrSize(oldtype);
-    newlen = (len+addlen);
+    reqlen = newlen = (len+addlen);
     if (newlen < SDS_MAX_PREALLOC)
         newlen *= 2;
     else
@@ -217,6 +217,7 @@ sds sdsMakeRoomFor(sds s, size_t addlen) {
     if (type == SDS_TYPE_5) type = SDS_TYPE_8;
 
     hdrlen = sdsHdrSize(type);
+    assert(hdrlen + newlen + 1 > reqlen);  /* Catch size_t overflow */
     if (oldtype==type) {
         newsh = s_realloc(sh, hdrlen+newlen+1);
         if (newsh == NULL) return NULL;