<p></p>
<p><a class="user-mention" data-hovercard-type="user" data-hovercard-url="/users/linuxmaniac/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/linuxmaniac">@linuxmaniac</a> Encountered a crash regarding this today.<br>
Relevant backtrace frame:</p>
<pre><code>#0  0x00007fdc33f5e906 in redisc_exec (srv=0x7ffcb7b121b0, res=0x7ffcb7b121d0, cmd=0x7ffcb7b121c0) at redis_client.c:1073
        rsrv = 0x7fdc63b2d878
        rpl = 0x7fdc63b2d1d0
        c = 0 '\000'
        ap = <error reading variable ap (Attempt to dereference a generic pointer.)>
        ap2 = <error reading variable ap2 (Attempt to dereference a generic pointer.)>
        ap3 = <error reading variable ap3 (Attempt to dereference a generic pointer.)>
        ap4 = <error reading variable ap4 (Attempt to dereference a generic pointer.)>
        ret = -1
        __func__ = "redisc_exec"
</code></pre>
<p>Let's look at the code for this, with the line number mentioned on the left:</p>
<pre><code>1052                 rpl->rplRedis = redisvCommand(rsrv->ctxRedis, cmd->s, ap3 );
1053                 if(rpl->rplRedis == NULL)
1054                 {
1055                         /* null reply, reconnect and try again */
1056                         if(rsrv->ctxRedis->err)
1057                         {
1058                                 LM_ERR("Redis error: %s\n", rsrv->ctxRedis->errstr);
1059                         }
1060                         if(redisc_reconnect_server(rsrv)==0)
1061                         {
1062                                 rpl->rplRedis = redisvCommand(rsrv->ctxRedis, cmd->s, ap4);
1063                         } else {
1064                                 LM_ERR("unable to reconnect to redis server: %.*s\n",
1065                                                 srv->len, srv->s);
1066                                 STR_ZTOV(cmd->s[cmd->len], c);
1067                                 goto error_exec;
1068                         }
1069                 }
1070         }
1071
1072         LM_DBG("rpl->rplRedis->type:%d\n", rpl->rplRedis->type);
1073         if(rpl->rplRedis->type == REDIS_REPLY_ERROR) {
1074                 LM_ERR("Redis error:%.*s\n",
1075                         (int)rpl->rplRedis->len, rpl->rplRedis->str);
1076                 goto error_exec;
1077         }
</code></pre>
<p>This crashes if the code at :1062 fails, since after that we don't perform a null check on <code>rpl->rplRedis</code> and try to get its type at :1072 (or :1073 if debug logging is disabled). Earlier this was not a problem since we never tried to fetch the reply type in this function after the missing null check.</p>
<p>Added a simple null check to fix this.</p>
<pre><code>diff --git a/src/modules/ndb_redis/redis_client.c b/src/modules/ndb_redis/redis_client.c
index 42880310f2..cd3f14c7fb 100644
--- a/src/modules/ndb_redis/redis_client.c
+++ b/src/modules/ndb_redis/redis_client.c
@@ -1059,6 +1059,11 @@ int redisc_exec(str *srv, str *res, str *cmd, ...)
                        if(redisc_reconnect_server(rsrv)==0)
                        {
                                rpl->rplRedis = redisvCommand(rsrv->ctxRedis, cmd->s, ap4);
+                               if (rpl->rplRedis == NULL)
+                               {
+                                       redis_count_err_and_disable(rsrv);
+                                       goto error_exec;
+                               }
                        } else {
                                LM_ERR("unable to reconnect to redis server: %.*s\n",
                                                srv->len, srv->s);
</code></pre>

<p style="font-size:small;-webkit-text-size-adjust:none;color:#666;">—<br />You are receiving this because you are subscribed to this thread.<br />Reply to this email directly, <a href="https://github.com/kamailio/kamailio/issues/2461#issuecomment-788821147">view it on GitHub</a>, or <a href="https://github.com/notifications/unsubscribe-auth/ABO7UZLFVAQ3SV4LIHBILF3TBTAH3ANCNFSM4QSBYYIA">unsubscribe</a>.<img src="https://github.com/notifications/beacon/ABO7UZKUABORMACMPSY2I5DTBTAH3A5CNFSM4QSBYYIKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOF4CHJGY.gif" height="1" width="1" alt="" /></p>
<script type="application/ld+json">[
{
"@context": "http://schema.org",
"@type": "EmailMessage",
"potentialAction": {
"@type": "ViewAction",
"target": "https://github.com/kamailio/kamailio/issues/2461#issuecomment-788821147",
"url": "https://github.com/kamailio/kamailio/issues/2461#issuecomment-788821147",
"name": "View Issue"
},
"description": "View this Issue on GitHub",
"publisher": {
"@type": "Organization",
"name": "GitHub",
"url": "https://github.com"
}
}
]</script>