Skip to content

Commit a648699

Browse files
authored
Fix double-free segmentation fault in filter handlers cleanup (#77)
1 parent b0e6b98 commit a648699

File tree

1 file changed

+9
-3
lines changed

1 file changed

+9
-3
lines changed

src/ext/handlersFilter.c

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -376,28 +376,34 @@ static RdbxFilter *createHandlersFilterCommon(RdbParser *p,
376376
ctx->exclude = exclude;
377377
ctx->cbReturnValue = RDB_OK;
378378

379+
/* Register destructor only once to avoid double-free */
380+
RdbFreeFunc destructor = deleteFilterCtx;
381+
379382
if (RDB_getNumHandlers(p, RDB_LEVEL_DATA)>0) {
380383
RdbHandlersDataCallbacks dataCb;
381384
defaultFilterDataCb(&dataCb);
382385
dataCb.handleNewKey = handleNewKey;
383386
dataCb.handleNewDb = handleNewDb;
384-
RDB_createHandlersData(p, &dataCb, ctx, deleteFilterCtx);
387+
RDB_createHandlersData(p, &dataCb, ctx, destructor);
388+
destructor = NULL; /* Only register destructor once */
385389
}
386390

387391
if (RDB_getNumHandlers(p, RDB_LEVEL_STRUCT)>0) {
388392
RdbHandlersStructCallbacks structCb;
389393
defaultFilterStructCb(&structCb);
390394
structCb.handleNewKey = handleNewKey;
391395
structCb.handleNewDb = handleNewDb;
392-
RDB_createHandlersStruct(p, &structCb, ctx, deleteFilterCtx);
396+
RDB_createHandlersStruct(p, &structCb, ctx, destructor);
397+
destructor = NULL; /* Only register destructor once */
393398
}
394399

395400
if (RDB_getNumHandlers(p, RDB_LEVEL_RAW)>0) {
396401
RdbHandlersRawCallbacks rawCb;
397402
defaultFilterRawCb(&rawCb);
398403
rawCb.handleNewKey = handleNewKey;
399404
rawCb.handleNewDb = handleNewDb;
400-
RDB_createHandlersRaw(p, &rawCb, ctx, deleteFilterCtx);
405+
RDB_createHandlersRaw(p, &rawCb, ctx, destructor);
406+
destructor = NULL; /* Only register destructor once */
401407
}
402408
return ctx;
403409
}

0 commit comments

Comments
 (0)