Commit 29049507 authored by Matt Stancliff's avatar Matt Stancliff Committed by antirez
Browse files

Fix potential invalid read past end of array

If array has N elements, we can't read +1 if we are already at N.

Also, we need to move elements by their storage size in the array,
not just by individual bytes.
parent 30152554
...@@ -783,8 +783,11 @@ int clusterNodeRemoveSlave(clusterNode *master, clusterNode *slave) { ...@@ -783,8 +783,11 @@ int clusterNodeRemoveSlave(clusterNode *master, clusterNode *slave) {
for (j = 0; j < master->numslaves; j++) { for (j = 0; j < master->numslaves; j++) {
if (master->slaves[j] == slave) { if (master->slaves[j] == slave) {
memmove(master->slaves+j,master->slaves+(j+1), if ((j+1) < master->numslaves) {
(master->numslaves-1)-j); int remaining_slaves = (master->numslaves - j) - 1;
memmove(master->slaves+j,master->slaves+(j+1),
(sizeof(*master->slaves) * remaining_slaves));
}
master->numslaves--; master->numslaves--;
return REDIS_OK; return REDIS_OK;
} }
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment