diff options
author | Yossi Gottlieb <yossigo@gmail.com> | 2021-11-21 15:54:14 +0200 |
---|---|---|
committer | GitHub <noreply@github.com> | 2021-11-21 15:54:14 +0200 |
commit | fd0ca74763f232336005b9bda889639a2bcd4a39 (patch) | |
tree | 296b0a5157f240942771601df4a7063de233f936 /src/networking.c | |
parent | 14176484697dc96df62c76630eef2b97a89bb8d0 (diff) | |
download | redis-fd0ca74763f232336005b9bda889639a2bcd4a39.tar.gz |
Fix occasional RM_Call() crashes. (#9805)
With dynamically growing argc (#9528), it is necessary to initialize
argv_len. Normally createClient() handles that, but in the case of a
module shared_client, this needs to be done explicitly.
This also addresses an issue with rewriteClientCommandArgument() which
doesn't properly handle the case where the new element extends beyond
argc but not beyond argv_len.
Diffstat (limited to 'src/networking.c')
-rw-r--r-- | src/networking.c | 13 |
1 files changed, 10 insertions, 3 deletions
diff --git a/src/networking.c b/src/networking.c index b33feac5c..73ea286e9 100644 --- a/src/networking.c +++ b/src/networking.c @@ -3276,9 +3276,16 @@ void replaceClientCommandVector(client *c, int argc, robj **argv) { void rewriteClientCommandArgument(client *c, int i, robj *newval) { robj *oldval; retainOriginalCommandVector(c); - if (i >= c->argv_len) { - c->argv = zrealloc(c->argv,sizeof(robj*)*(i+1)); - c->argc = c->argv_len = i+1; + + /* We need to handle both extending beyond argc (just update it and + * initialize the new element) or beyond argv_len (realloc is needed). + */ + if (i >= c->argc) { + if (i >= c->argv_len) { + c->argv = zrealloc(c->argv,sizeof(robj*)*(i+1)); + c->argv_len = i+1; + } + c->argc = i+1; c->argv[i] = NULL; } oldval = c->argv[i]; |