Fix potential fault at createDoubleObject

[afcidk]

Resolves #963.

Add additional check to hi_malloc for r->str when len+1 equals to 0.

[bjosv]

In which case would len be -1 here as described in #963 ?
Ien is a size_t, i.e. an unsigned integer, and when the function is called using a signed integer the conversion rules
in 6.3.1.3 (bullet 2) of the c99 standard would apply.

[michael-grunder]

I think it makes sense to protect against hi_malloc(len + 1) when len == SIZE_MAX but I wonder if that's the more straightforward way to do it.

Just test that at the top of the routine and return NULL if it is true.

If we're feeling ambitious I suppose we could limit the maximum value here to a much more sane length.

More detail in this SO question

[bjosv]

Ahh, yes, that's a potential issue. Testing in the top of the routine would be simple and pragmatic.

[afcidk]

Sorry about confusing with -1.

This function is currently not able to be called if parameter len is larger than 326.

hiredis/read.c

Lines 290 to 297 in dfa33e6

	char buf[326], *eptr;
	double d;
	if ((size_t)len >= sizeof(buf)) {
	__redisReaderSetError(r,REDIS_ERR_PROTOCOL,
	"Double value is too large");
	return REDIS_ERR;
	}

However, this check depends on the buffer size, which seems not so stable.

[zuiderkwast]

If len < 326 at this point, it means the added return NULL; is dead code. Better add an assert(len < SIZE_MAX) instead then.