antirez/redis — pull request #1944 by paddybyers (2014-08-15 20:25:03+00:00)
Title: Script argv fix

This fixes a bug introduced by this commit:

https://github.com/antirez/redis/commit/8237d88f48e0843839eb530c408686d66bcae6ab

The length of the static argv is not stored when it is first created; only when extended. On the first occasion this is relatively harmless (since the initialised length was 0), but on any subsequent "first" allocation - eg after having been cleared here: https://github.com/antirez/redis/blob/8237d88f48e0843839eb530c408686d66bcae6ab/src/scripting.c#L352

then a new allocated argv implicitly inherits the length of the last freed one. Where the new argv is smaller than the last freed one, and then later reused without extension at any length greater than its actual length, memory is overwritten.

This fixes issue #1939.

See also related issue #1943.