fix UAF in scan mode

chenyang8094 · chenyang8094 · commit a5488b9197a8 · 2026-01-26T13:45:49.000+08:00
diff --git a/src/scan_algorithm.c b/src/scan_algorithm.c
@@ -239,6 +239,7 @@ void passiveExpire(RedisModuleCtx *ctx, int dbid, RedisModuleString *key) {
         start_index = 0;
         ln = tair_hash_obj->expire_index->header->level[0].forward;
         while (ln && keys_per_loop) {
+            m_zskiplistNode *next = ln->level[0].forward;
             field = ln->member;
             if (fieldExpireIfNeeded(ctx, dbid, key, tair_hash_obj, field, 0)) {
                 g_expire_algorithm.stat_passive_expired_field[dbid]++;
@@ -250,7 +251,7 @@ void passiveExpire(RedisModuleCtx *ctx, int dbid, RedisModuleString *key) {
             } else {
                 break;
             }
-            ln = ln->level[0].forward;
+            ln = next;
         }
 
         if (may_delkey) {
@@ -265,7 +266,6 @@ void passiveExpire(RedisModuleCtx *ctx, int dbid, RedisModuleString *key) {
         }
 
         if (start_index) {
-            m_zslDeleteRangeByRank(tair_hash_obj->expire_index, 1, start_index);
             delEmptyTairHashIfNeeded(ctx, NULL, key, tair_hash_obj);
         }
         m_listDelNode(keys, node);

Original file line number	Diff line number	Diff line change
`@@ -239,6 +239,7 @@ void passiveExpire(RedisModuleCtx ctx, int dbid, RedisModuleString key) {`
`239`	`239`	`start_index = 0;`
`240`	`240`	`ln = tair_hash_obj->expire_index->header->level[0].forward;`
`241`	`241`	`while (ln && keys_per_loop) {`
	`242`	`+ m_zskiplistNode *next = ln->level[0].forward;`
`242`	`243`	`field = ln->member;`
`243`	`244`	`if (fieldExpireIfNeeded(ctx, dbid, key, tair_hash_obj, field, 0)) {`
`244`	`245`	`g_expire_algorithm.stat_passive_expired_field[dbid]++;`
`@@ -250,7 +251,7 @@ void passiveExpire(RedisModuleCtx ctx, int dbid, RedisModuleString key) {`
`250`	`251`	`} else {`
`251`	`252`	`break;`
`252`	`253`	`}`
`253`		`- ln = ln->level[0].forward;`
	`254`	`+ ln = next;`
`254`	`255`	`}`
`255`	`256`
`256`	`257`	`if (may_delkey) {`
`@@ -265,7 +266,6 @@ void passiveExpire(RedisModuleCtx ctx, int dbid, RedisModuleString key) {`
`265`	`266`	`}`
`266`	`267`
`267`	`268`	`if (start_index) {`
`268`		`- m_zslDeleteRangeByRank(tair_hash_obj->expire_index, 1, start_index);`
`269`	`269`	`delEmptyTairHashIfNeeded(ctx, NULL, key, tair_hash_obj);`
`270`	`270`	`}`
`271`	`271`	`m_listDelNode(keys, node);`