segfault when redis server goes away

[nrk]

segfault when redis server goes away

[theintz]

The issue happens due to an attempt to free() an uninitialized pointer. More precisely: the pointer reply is created at the top of phpiredis_command_bs() and not initialized. It is then passed into redisGetReply(), where it is normally replaced with a pointer to a valid redisReply object and all is good.

However, when the server goes away, this pointer is never replaced, so when freeReplyObject(reply) is called, it is actually operating on an uninitialized pointer, which causes the segfault.

A similar problem was addressed in bccb042, but never really done properly.

Two ideas on how to avoid the segfault:

1. As its impossible to check for an uninitialized pointer, the pointer could be set to NULL upon declaration. Later it could be checked for that value and only freed when it is not NULL:

if (reply) freeRedisReply(reply);

1. When an error occurrs, the err field in the redis context is populated. Depending on the value of this field, the code could decide whether to free or not free the reply:

if (connection->c->err != REDIS_ERR_IO) freeRedisReply();

Number 1 seems cleaner, but we have tried this, and experienced some strange behavior. Maybe someone else knows how to do it properly? Number 2 seems like a hack, and may vreate a memory leak.

[theintz]

Ok, so initializing the pointer to NULL is really the proper way. I have opened a pull request with that fix. Please review quickly.

[nrk]

@theintz thanks for the detailed report and PR #21 and sorry for being so late, I'm finally starting to slowly get back to my open-source projects after a long hiatus due to the lack of free time. I just started reviewing your other (and more substantial) pull request.