Skip to content

Commit 829d118

Browse files
committed
cachedb_redis: restore NULL check after redisConnect/redisConnectUnix
If hiredis returns NULL (OOM), the previous `ctx && ctx->err` guard skipped the error branch and fell through to redisSetTimeout(ctx, ...), causing a NULL-pointer dereference. Split into separate !ctx and ctx->err checks so OOM is caught before any ctx dereference. Reported-by: dondetir <dondetir@users.noreply.github.com>
1 parent 5de24f1 commit 829d118

1 file changed

Lines changed: 12 additions & 2 deletions

File tree

modules/cachedb_redis/cachedb_redis_dbase.c

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,12 @@ redisContext *redis_get_ctx(char *ip, int port)
8080
tv.tv_usec = (redis_connnection_tout * 1000) % 1000000;
8181
ctx = redisConnectWithTimeout(ip,port,tv);
8282
}
83-
if (ctx && ctx->err != REDIS_OK) {
83+
if (!ctx) {
84+
LM_ERR("failed to connect to redis %s:%hu - out of memory\n",
85+
ip, (unsigned short)port);
86+
return NULL;
87+
}
88+
if (ctx->err != REDIS_OK) {
8489
LM_ERR("failed to open redis connection %s:%hu - %s\n",ip,
8590
(unsigned short)port,ctx->errstr);
8691
redisFree(ctx);
@@ -130,7 +135,12 @@ redisContext *redis_get_ctx_unix(const char *socket_path)
130135
tv.tv_usec = (redis_connnection_tout * 1000) % 1000000;
131136
ctx = redisConnectUnixWithTimeout(socket_path, tv);
132137
}
133-
if (ctx && ctx->err != REDIS_OK) {
138+
if (!ctx) {
139+
LM_ERR("failed to connect to redis unix:%s - out of memory\n",
140+
socket_path);
141+
return NULL;
142+
}
143+
if (ctx->err != REDIS_OK) {
134144
LM_ERR("failed to open redis Unix socket connection %s - %s\n",
135145
socket_path, ctx->errstr);
136146
redisFree(ctx);

0 commit comments

Comments
 (0)