Fix use after free replication data block

Signed-off-by: naglera <[email protected]>
naglera · Jun 9, 2024 · f6a75be · f6a75be
1 parent c2fe4e2
commit f6a75be
Showing 1 changed file with 7 additions and 6 deletions.
diff --git a/src/replication.c b/src/replication.c
@@ -2931,18 +2931,19 @@ void bufferReplData(connection *conn) {
 void streamReplDataBufToDb(client *c) {
     serverAssert(c->flags & CLIENT_MASTER);
     blockingOperationStarts();
-    size_t offset = 0;
+    size_t offset, used = 0;
     listNode *cur = NULL;
     time_t last_progress_callback = mstime();
     while ((cur = listFirst(server.pending_repl_data.blocks))) {
         /* Read and process repl data block */
         replDataBufBlock *o = listNodeValue(cur);
-        c->querybuf = sdscatlen(c->querybuf, o->buf, o->used);
-        c->read_reploff += o->used;
+        used = o->used;
+        c->querybuf = sdscatlen(c->querybuf, o->buf, used);
+        c->read_reploff += used;
         processInputBuffer(c);
-        server.pending_repl_data.len -= o->used;
-        replStreamProgressCallback(offset, o->used, &last_progress_callback);
-        offset += o->used;
+        server.pending_repl_data.len -= used;
+        replStreamProgressCallback(offset, used, &last_progress_callback);
+        offset += used;
         listDelNode(server.pending_repl_data.blocks, cur);
     }
     blockingOperationEnds();