Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

_arena of RedisReply should not be swapped as it always point to RedisResponse._arena #2343

Closed
heartplus opened this issue Aug 3, 2023 · 0 comments · Fixed by #2340
Closed

Comments

@heartplus
Copy link

Describe the bug (描述bug)

inline void RedisReply::Swap(RedisReply& other) {
std::swap(_type, other._type);
std::swap(_length, other._length);
std::swap(_data.padding[0], other._data.padding[0]);
std::swap(_data.padding[1], other._data.padding[1]);
std::swap(_arena, other._arena); <<<<<<<<<<--------- _arena should not be swapped
}

To Reproduce (复现方法)

TEST_F(ClientInitTest, RedisResponse) {
std::string msg = "+";
msg.resize(300, 'x');
msg.append("\r\n");

brpc::RedisResponse* resp1 = new brpc::RedisResponse();
brpc::RedisResponse* resp2 = new brpc::RedisResponse();

resp1->Swap(resp2);

char* ptr = (char*)resp2;
delete resp2;
// make sure memory is definitely freed
memset(ptr, 0xff, sizeof(brpc::RedisResponse));

butil::IOBuf buf;
buf.append(msg);
auto err = resp1->ConsumePartialIOBuf(buf, 1);
ASSERT_EQ(0, err);
delete resp1;

}

Expected behavior (期望行为)
no segment fault

Versions (各种版本)
OS: all
Compiler: all
brpc: all
protobuf: all

Additional context/screenshots (更多上下文/截图)
no

@chenBright chenBright linked a pull request Aug 3, 2023 that will close this issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant