gvsafronov/futriix
1
0
Fork 0
Code Issues Pull Requests Actions 4 Packages Projects Releases Wiki Activity

Set fields to NULL after free in freeClient() (#1279)

Browse Source 
Null out several references after freeing the object in `freeClient()`.

This is just to make the code more safe, to protect against
use-after-free for future changes.

Signed-off-by: Qu Chen <quchen@amazon.com>
This commit is contained in:
Qu Chen 2024-11-11 01:39:48 -08:00 committed by GitHub
parent 0b5b2c7484
commit 9300a7ebc8
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/networking.c
View File

@ -1731,6 +1731,7 @@ void freeClient(client *c) {
/* UNWATCH all the keys */ /* UNWATCH all the keys */
unwatchAllKeys(c); unwatchAllKeys(c);
listRelease(c->watched_keys); listRelease(c->watched_keys);
c->watched_keys = NULL;
/* Unsubscribe from all the pubsub channels */ /* Unsubscribe from all the pubsub channels */
pubsubUnsubscribeAllChannels(c, 0); pubsubUnsubscribeAllChannels(c, 0);
@ -1738,16 +1739,22 @@ void freeClient(client *c) {
pubsubUnsubscribeAllPatterns(c, 0); pubsubUnsubscribeAllPatterns(c, 0);
unmarkClientAsPubSub(c); unmarkClientAsPubSub(c);
dictRelease(c->pubsub_channels); dictRelease(c->pubsub_channels);
c->pubsub_channels = NULL;
dictRelease(c->pubsub_patterns); dictRelease(c->pubsub_patterns);
c->pubsub_patterns = NULL;
dictRelease(c->pubsubshard_channels); dictRelease(c->pubsubshard_channels);
c->pubsubshard_channels = NULL;
/* Free data structures. */ /* Free data structures. */
listRelease(c->reply); listRelease(c->reply);
c->reply = NULL;
zfree(c->buf); zfree(c->buf);
c->buf = NULL;
freeReplicaReferencedReplBuffer(c); freeReplicaReferencedReplBuffer(c);
freeClientArgv(c); freeClientArgv(c);
freeClientOriginalArgv(c); freeClientOriginalArgv(c);
if (c->deferred_reply_errors) listRelease(c->deferred_reply_errors); if (c->deferred_reply_errors) listRelease(c->deferred_reply_errors);
c->deferred_reply_errors = NULL;
#ifdef LOG_REQ_RES #ifdef LOG_REQ_RES
reqresReset(c, 1); reqresReset(c, 1);
#endif #endif