fluencelabs/redis
1
0
Fork 0
mirror of https://github.com/fluencelabs/redis synced 2025-03-19 00:50:50 +00:00
Code Issues Projects Releases Wiki Activity

Fix potential invalid read past end of array

Browse Source 
If array has N elements, we can't read +1 if we are already at N.

Also, we need to move elements by their storage size in the array,
not just by individual bytes.
This commit is contained in:
Matt Stancliff 2015-01-14 11:10:25 -05:00 committed by antirez
parent 30152554ea
commit 29049507ec
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/cluster.c
View File

@ -783,8 +783,11 @@ int clusterNodeRemoveSlave(clusterNode *master, clusterNode *slave) {
for (j = 0; j < master->numslaves; j++) { for (j = 0; j < master->numslaves; j++) {
if (master->slaves[j] == slave) { if (master->slaves[j] == slave) {
if ((j+1) < master->numslaves) {
int remaining_slaves = (master->numslaves - j) - 1;
memmove(master->slaves+j,master->slaves+(j+1), memmove(master->slaves+j,master->slaves+(j+1),
(master->numslaves-1)-j); (sizeof(*master->slaves) * remaining_slaves));
}
master->numslaves--; master->numslaves--;
return REDIS_OK; return REDIS_OK;
} }