From 4d6fd8d7cd8902df9b112a4cc389ef076b014c07 Mon Sep 17 00:00:00 2001
From: Hristo Staykov <hristo.staykov@redis.com>
Date: Mon, 16 Mar 2026 15:08:57 +0200
Subject: [PATCH] Fix cardinality type in sunionDiffGenericCommand to avoid
 truncation

The cardinality variable was declared as int while the limit parameter
is long. The assignment cardinality = limit in the early-termination
path could silently truncate for LIMIT values exceeding INT_MAX. Change
cardinality from int to long to match limit. Kept as signed (unlike
sinterGenericCommand's unsigned long) because the DIFF path decrements
cardinality.
---
 src/t_set.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/t_set.c b/src/t_set.c
index 61c5f80de..7522a68cf 100644
--- a/src/t_set.c
+++ b/src/t_set.c
@@ -1645,8 +1645,8 @@ void sunionDiffGenericCommand(client *c, robj **setkeys, int setnum,
     size_t len = 0;
     int64_t llval = 0;
     int encoding;
-    int j, cardinality = 0;
-    int diff_algo = 1;
+    int j, diff_algo = 1;
+    long cardinality = 0;
     int sameset = 0; 
 
     for (j = 0; j < setnum; j++) {