Commit 6540e9ee authored by antirez's avatar antirez
Browse files

Fix off by one bug in freeMemoryIfNeeded() eviction pool.

Bug found by the continuous integration test running the Redis
with valgrind:

==6245== Invalid read of size 8
==6245==    at 0x4C2DEEF: memcpy@GLIBC_2.2.5 (mc_replace_strmem.c:876)
==6245==    by 0x41F9E6: freeMemoryIfNeeded (redis.c:3010)
==6245==    by 0x41D2CC: processCommand (redis.c:2069)

memmove() size argument was accounting for an extra element, going
outside the bounds of the array.
parent 9e0b9f12
...@@ -3040,7 +3040,7 @@ int freeMemoryIfNeeded(void) { ...@@ -3040,7 +3040,7 @@ int freeMemoryIfNeeded(void) {
sdsfree(pool[k].key); sdsfree(pool[k].key);
/* Shift all elements on its right to left. */ /* Shift all elements on its right to left. */
memmove(pool+k,pool+k+1, memmove(pool+k,pool+k+1,
sizeof(pool[0])*(REDIS_EVICTION_POOL_SIZE-k)); sizeof(pool[0])*(REDIS_EVICTION_POOL_SIZE-k-1));
/* Clear the element on the right which is empty /* Clear the element on the right which is empty
* since we shifted one position to the left. */ * since we shifted one position to the left. */
pool[REDIS_EVICTION_POOL_SIZE-1].key = NULL; pool[REDIS_EVICTION_POOL_SIZE-1].key = NULL;
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment