Skip to content

Commit a392dbc

Browse files
committed
cachedb_redis: restore NULL check after redisConnect/redisConnectUnix
If hiredis returns NULL (OOM), the previous `ctx && ctx->err` guard skipped the error branch and fell through to redisSetTimeout(ctx, ...), causing a NULL-pointer dereference. Split into separate !ctx and ctx->err checks so OOM is caught before any ctx dereference. Reported-by: dondetir <dondetir@users.noreply.github.com>
1 parent 16652c1 commit a392dbc

1 file changed

Lines changed: 12 additions & 2 deletions

File tree

modules/cachedb_redis/cachedb_redis_dbase.c

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,12 @@ redisContext *redis_get_ctx(char *ip, int port)
8080
tv.tv_usec = (redis_connnection_tout * 1000) % 1000000;
8181
ctx = redisConnectWithTimeout(ip,port,tv);
8282
}
83-
if (ctx && ctx->err != REDIS_OK) {
83+
if (!ctx) {
84+
LM_ERR("failed to connect to redis %s:%hu - out of memory\n",
85+
ip, (unsigned short)port);
86+
return NULL;
87+
}
88+
if (ctx->err != REDIS_OK) {
8489
LM_ERR("failed to open redis connection %s:%hu - %s\n",ip,
8590
(unsigned short)port,ctx->errstr);
8691
redisFree(ctx);
@@ -126,7 +131,12 @@ redisContext *redis_get_ctx_unix(const char *socket_path)
126131
tv.tv_usec = (redis_connnection_tout * 1000) % 1000000;
127132
ctx = redisConnectUnixWithTimeout(socket_path, tv);
128133
}
129-
if (ctx && ctx->err != REDIS_OK) {
134+
if (!ctx) {
135+
LM_ERR("failed to connect to redis unix:%s - out of memory\n",
136+
socket_path);
137+
return NULL;
138+
}
139+
if (ctx->err != REDIS_OK) {
130140
LM_ERR("failed to open redis Unix socket connection %s - %s\n",
131141
socket_path, ctx->errstr);
132142
redisFree(ctx);

0 commit comments

Comments
 (0)