Redis segfaults in addReply function when I run redis-benchmark against it and connect two slaves simultaneously. The cause seems to be a typo in the dupClientReplyValue function:

--- redis-1.2.1-orig/redis.c    2010-02-18 12:40:23.000000000 +0100
+++ redis-1.2.1/redis.c    2010-02-18 12:42:03.000000000 +0100
@@ -1975,7 +1975,7 @@

 static void *dupClientReplyValue(void *o) {
     incrRefCount((robj*)o);
-    return 0;
+    return o;
 }

It returned a NULL pointer that was used afterwards as a list*. The patched version ran for 24+ hours with slaves and redis-benchmark reconnecting periodically.

The patch was made for 1.2.1 but the above function is the same in 1.2.2.