• Meir Shpilraien (Spielrein)'s avatar
    Fix use after free on blocking RM_Call. (#12342) · 153f8f08
    Meir Shpilraien (Spielrein) authored
    blocking RM_Call was introduced on: #11568, It allows a module to perform
    blocking commands and get the reply asynchronously.If the command gets
    block, a special promise CallReply is returned that allow to set the unblock
    handler. The unblock handler will be called when the command invocation
    finish and it gets, as input, the command real reply.
    
    The issue was that the real CallReply was created using a stack allocated
    RedisModuleCtx which is no longer available after the unblock handler finishes.
    So if the module keeps the CallReply after the unblock handler finished, the
    CallReply holds a pointer to invalid memory and will try to access it when the
    CallReply will be released.
    
    The solution is to create the CallReply with a NULL context to make it totally
    detached and can be freed freely when the module wants.
    
    Test was added to cover this case, running the test with valgrind before the
    fix shows the use after free error. With the fix, there are no valgrind errors.
    
    unrelated: adding a missing `$rd close` in many tests in that file.
    153f8f08
module.c 560 KB