"vscode:/vscode.git/clone" did not exist on "c4286feabef25b417d05251e4a63ef769ac4cfad"
Commit 6540e9ee authored by antirez's avatar antirez
Browse files

Fix off by one bug in freeMemoryIfNeeded() eviction pool.

Bug found by the continuous integration test running the Redis
with valgrind:

==6245== Invalid read of size 8
==6245==    at 0x4C2DEEF: memcpy@GLIBC_2.2.5 (mc_replace_strmem.c:876)
==6245==    by 0x41F9E6: freeMemoryIfNeeded (redis.c:3010)
==6245==    by 0x41D2CC: processCommand (redis.c:2069)

memmove() size argument was accounting for an extra element, going
outside the bounds of the array.
parent 9e0b9f12
...@@ -3040,7 +3040,7 @@ int freeMemoryIfNeeded(void) { ...@@ -3040,7 +3040,7 @@ int freeMemoryIfNeeded(void) {
sdsfree(pool[k].key); sdsfree(pool[k].key);
/* Shift all elements on its right to left. */ /* Shift all elements on its right to left. */
memmove(pool+k,pool+k+1, memmove(pool+k,pool+k+1,
sizeof(pool[0])*(REDIS_EVICTION_POOL_SIZE-k)); sizeof(pool[0])*(REDIS_EVICTION_POOL_SIZE-k-1));
/* Clear the element on the right which is empty /* Clear the element on the right which is empty
* since we shifted one position to the left. */ * since we shifted one position to the left. */
pool[REDIS_EVICTION_POOL_SIZE-1].key = NULL; pool[REDIS_EVICTION_POOL_SIZE-1].key = NULL;
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment