antirez/redis — pull request #1945 by paddybyers (2014-08-15 21:03:16+00:00)
Title: Store the length of the static argv when first allocated.

This fixes a bug introduced by this commit:

8237d88

The length of the static argv is not stored when it is first created; only when extended. On the first occasion this is relatively harmless (since the initialised length was 0), but on any subsequent "first" allocation - eg after having been cleared here: https://github.com/antirez/redis/blob/8237d88f48e0843839eb530c408686d66bcae6ab/src/scripting.c#L352

then a new allocated argv implicitly inherits the length of the last freed one. Where the new argv is smaller than the last freed one, and then later reused without extension at any length greater than its actual length, memory is overwritten.

This fixes issue #1939.

See also related issue #1943.