Skip to content

Commit 1cc3490

Browse files
NormBrazvancrainea
authored andcommitted
cachedb_redis: fix NULL deref when redisConnect returns NULL
redisConnect() and redisConnectWithTimeout() can return NULL on allocation failure. The existing check only handles ctx->err != REDIS_OK (non-NULL ctx with error), so a NULL return falls through to redisSetTimeout(NULL, ...) which dereferences the NULL pointer. Add an explicit NULL check after the error-code check. Also change the warned flag from char to int to avoid undefined behavior on signed overflow after 127 connection-timeout warnings.
1 parent 5623d3d commit 1cc3490

1 file changed

Lines changed: 7 additions & 1 deletion

File tree

modules/cachedb_redis/cachedb_redis_dbase.c

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ static unsigned int redis_calc_escaped_len_json(str *s);
5858
redisContext *redis_get_ctx(char *ip, int port)
5959
{
6060
struct timeval tv;
61-
static char warned = 0;
61+
static int warned = 0;
6262
redisContext *ctx;
6363

6464
if (!port)
@@ -79,6 +79,12 @@ redisContext *redis_get_ctx(char *ip, int port)
7979
return NULL;
8080
}
8181

82+
if (!ctx) {
83+
LM_ERR("failed to connect to redis %s:%hu - out of memory\n",
84+
ip, (unsigned short)port);
85+
return NULL;
86+
}
87+
8288
if (redis_query_tout) {
8389
tv.tv_sec = redis_query_tout / 1000;
8490
tv.tv_usec = (redis_query_tout * 1000) % 1000000;

0 commit comments

Comments
 (0)