Fix UAF bug (#14)

chenyang8094 · web-flow · commit fa5073f19126 · 2021-11-19T22:40:34.000+08:00
* Fix UAF bug

* Fix uaf
diff --git a/src/tairhash.c b/src/tairhash.c
@@ -374,6 +374,7 @@ int delEmptyTairHashIfNeeded(RedisModuleCtx *ctx, RedisModuleKey *key, RedisModu
                    https://github.com/redis/redis/pull/8097 
                    https://github.com/redis/redis/pull/7037
      */
+    RedisModule_CloseKey(key);
     RedisModuleCtx *ctx2 = RedisModule_GetThreadSafeContext(NULL);
     RedisModule_SelectDb(ctx2, RedisModule_GetSelectedDb(ctx));
     RedisModuleCallReply *reply = RedisModule_Call(ctx2, "DEL", "s!", raw_key);
@@ -508,6 +509,7 @@ void activeExpireTimerHandler(RedisModuleCtx *ctx, void *data) {
                                 m_listAddNodeTail(keys, key);
                             }
                         }
+                        RedisModule_CloseKey(real_key);
                     }
                     break;
                 }

Original file line number	Diff line number	Diff line change
`@@ -374,6 +374,7 @@ int delEmptyTairHashIfNeeded(RedisModuleCtx ctx, RedisModuleKey key, RedisModu`
`374`	`374`	`https://github.com/redis/redis/pull/8097`
`375`	`375`	`https://github.com/redis/redis/pull/7037`
`376`	`376`	`*/`
	`377`	`+ RedisModule_CloseKey(key);`
`377`	`378`	`RedisModuleCtx *ctx2 = RedisModule_GetThreadSafeContext(NULL);`
`378`	`379`	`RedisModule_SelectDb(ctx2, RedisModule_GetSelectedDb(ctx));`
`379`	`380`	`RedisModuleCallReply *reply = RedisModule_Call(ctx2, "DEL", "s!", raw_key);`
`@@ -508,6 +509,7 @@ void activeExpireTimerHandler(RedisModuleCtx ctx, void data) {`
`508`	`509`	`m_listAddNodeTail(keys, key);`
`509`	`510`	`}`
`510`	`511`	`}`
	`512`	`+ RedisModule_CloseKey(real_key);`
`511`	`513`	`}`
`512`	`514`	`break;`
`513`	`515`	`}`