New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[BUG] A use after free bug in replicationCron #8797
Comments
Thanks @Yunlongs |
My network proxy is something wrong, i cannot subimt a PR now.. |
Yeah, no worries. If you can't, we'll fix soon. |
guybe7
added a commit
to guybe7/redis
that referenced
this issue
Apr 16, 2021
This was referenced Apr 16, 2021
oranagra
pushed a commit
that referenced
this issue
Apr 16, 2021
oranagra
pushed a commit
to oranagra/redis
that referenced
this issue
May 3, 2021
Fixes redis#8797 (cherry picked from commit a60016e)
oranagra
pushed a commit
to oranagra/redis
that referenced
this issue
Jul 21, 2021
Fixes redis#8797 (cherry picked from commit a60016e)
oranagra
pushed a commit
that referenced
this issue
Jul 21, 2021
JackieXie168
pushed a commit
to JackieXie168/redis
that referenced
this issue
Sep 8, 2021
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Describe the bug
File: src/replication.c
In function
replicationCron()
,slave
is freed byfreeClient(slave)
at line 3,404.But the freed
slave
is dereferenced at line 3,410 byslave->replstate
.It causes a use after free.
Expected behavior
After the
slave
is freed, the freed chunk could be allocated by other objects and rewrite the value ofslave->replstate
,it could cause crash or others.
I think we should set a new variable to accept the value of
slave->replstate
before the firstif
branch, and use the new variable later.The text was updated successfully, but these errors were encountered: