Skip to content

[BUG] Possible memleak in tracking.c #14188

@sfu2

Description

@sfu2

Describe the bug

A potential memory leak in the function trackingRememberKeys, affecting redis-server.

To reproduce

  1. HERE result gets initialized, with result->keys set to NULL and result->numkeys set to MAX_KEYS_BUFFER(6)
  2. HERE getKeysFromCommand gets called, with &result as the last parameter.
  3. HERE For commands such as PUBSUB NUMSUB, getKeysUsingLegacyRangeSpec gets called with result as the last parameter.
  4. HERE getKeysPrepareResult gets called. For commands with recurring keys, count here can exceed MAX_KEYS_BUFFER(6)
  5. HERE Since result->keys was set to NULL, here result->keys points to result->keysbuf
  6. HERE Condition numkeys > result->size can be satisfied, as count here can exceed MAX_KEYS_BUFFER(6) in step 4.
  7. HERE Since result->keys == result->keysbuf, result->keys now points to heap-allocated memory.
  8. HERE Back to the function trackingRememberKeys, if commands are from the PUBSUB group, the function returns without calling getKeysFreeResult(&result).

Expected behavior

HERE the function trackingRememberKeys should return after calling getKeysFreeResult(&result).

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions