Redis/redis
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Sanitize dump payload: fix double free after insert dup nodekey to stream rax and returns 0 (#9399)

Browse Source 
(cherry picked from commit 492d8d0961)
This commit is contained in:
sundb
2021-10-04 13:59:40 +03:00
committed by Oran Agra
parent 2f8ec0e024
commit a2e8a3a241
2 changed files with 14 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/rdb.c
+4 -3
View File
@@ -2072,7 +2072,7 @@ robj *rdbLoadObject(int rdbtype, rio *rdb, sds key, int *error) {
}
/* Insert the key in the radix tree. */
int retval = raxInsert(s->rax,
int retval = raxTryInsert(s->rax,
(unsigned char*)nodekey,sizeof(streamID),lp,NULL);
sdsfree(nodekey);
if (!retval) {
@@ -2161,7 +2161,7 @@ robj *rdbLoadObject(int rdbtype, rio *rdb, sds key, int *error) {
streamFreeNACK(nack);
return NULL;
}
if (!raxInsert(cgroup->pel,rawid,sizeof(rawid),nack,NULL)) {
if (!raxTryInsert(cgroup->pel,rawid,sizeof(rawid),nack,NULL)) {
rdbReportCorruptRDB("Duplicated global PEL entry "
"loading stream consumer group");
decrRefCount(o);
@@ -2225,11 +2225,12 @@ robj *rdbLoadObject(int rdbtype, rio *rdb, sds key, int *error) {
* loading the global PEL. Then set the same shared
* NACK structure also in the consumer-specific PEL. */
nack->consumer = consumer;
if (!raxInsert(consumer->pel,rawid,sizeof(rawid),nack,NULL)) {
if (!raxTryInsert(consumer->pel,rawid,sizeof(rawid),nack,NULL)) {
rdbReportCorruptRDB("Duplicated consumer PEL entry "
" loading a stream consumer "
"group");
decrRefCount(o);
streamFreeNACK(nack);
return NULL;
}
}