Skip to content

Commit dbe07b7

Browse files
dvkashapovranshid
andauthored
Untrack key based on old->hasembkey (valkey-io#3007)
In `dbSetValue()` the `old` pointer may be reassigned to point to the incoming value object which was created without an embedded key, so calling `dbUntrackKeyWithVolatileItems()` would call `objectGetKey()` which returns NULL, causing a crash in `hashtableSdsHash()` when trying to hash the NULL key. Idea is to assign `old_was_hash_with_volatile` before the swap and use `new` instead of `old` for untracking when theres no embedded key. Introduced in valkey-io#3003 Run with NULL ptr dereference: https://github.com/valkey-io/valkey/actions/runs/20701343184/job/59424029880 --------- Signed-off-by: Daniil Kashapov <daniil.kashapov.ykt@gmail.com> Co-authored-by: Ran Shidlansik <ranshid@amazon.com>
1 parent e4a3e9f commit dbe07b7

File tree

1 file changed

+4
-1
lines changed

1 file changed

+4
-1
lines changed

src/db.c

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -373,7 +373,10 @@ static void dbSetValue(serverDb *db, robj *key, robj **valref, int overwrite, vo
373373

374374
/* If overwriting a hash object, un-track it from the volatile items tracking if it contains volatile items.*/
375375
if (old->type == OBJ_HASH && hashTypeHasVolatileFields(old)) {
376-
dbUntrackKeyWithVolatileItems(db, old);
376+
/* Some commands create a new value (with NO key) and use setKey to change the value of an existing key.
377+
* In this case the old can be replaced with the provided value and be left without a key
378+
* however it is still a hashObject with optional volatile items and we need to untrack it. */
379+
dbUntrackKeyWithVolatileItems(db, old->hasembkey ? old : new);
377380
}
378381
/* If the new object is a hash with volatile items we need to track it again */
379382
dbTrackKeyWithVolatileItems(db, new);

0 commit comments

Comments
 (0)