More allocation fixes

michael-grunder · michael-grunder · commit c51b0a1fd1cc · 2016-02-05T09:58:37.000-08:00
There were a few more places mixing emalloc(sizeof(zval*)*N) with emalloc(sizeof(zval)*N causing us to overwrite data in the stack. These didn't appear until the code was built in release mode. Now to build in debug mode to get rid of any leaks. Addresses phpredis#727
diff --git a/redis_cluster.c b/redis_cluster.c
@@ -641,7 +641,7 @@ static int cluster_mkey_cmd(INTERNAL_FUNCTION_PARAMETERS, char *kw, int kw_len,
     if (!argc) return -1;
 
     /* Extract our arguments into an array */
-    z_args = emalloc(sizeof(zval*)*argc);
+    z_args = emalloc(sizeof(*z_args) * argc);
     if (zend_get_parameters_array(ht, ZEND_NUM_ARGS(), z_args) == FAILURE) {
         efree(z_args);
         return -1;
@@ -857,7 +857,7 @@ PHP_METHOD(RedisCluster, del) {
     // Initialize a LONG value to zero for our return
     z_ret = emalloc(sizeof(*z_ret));
     ZVAL_LONG(z_ret, 0);
-
+    
     // Parse args, process
     if(cluster_mkey_cmd(INTERNAL_FUNCTION_PARAM_PASSTHRU, "DEL",
                         sizeof("DEL")-1, z_ret, cluster_del_resp)<0)
@@ -906,16 +906,18 @@ PHP_METHOD(RedisCluster, mset) {
 
 /* {{{ proto array RedisCluster::msetnx(array keyvalues) */
 PHP_METHOD(RedisCluster, msetnx) {
-    zval z_ret;
+    zval *z_ret;
 
     // Array response
-    array_init(&z_ret);
+    z_ret = emalloc(sizeof(*z_ret));
+    array_init(z_ret);
 
     // Parse args and process.  If we get a failure, free mem and return FALSE
     if(cluster_mset_cmd(INTERNAL_FUNCTION_PARAM_PASSTHRU, "MSETNX",
-                        sizeof("MSETNX")-1, &z_ret, cluster_msetnx_resp)==-1)
+                        sizeof("MSETNX")-1, z_ret, cluster_msetnx_resp)==-1)
     {
-        zval_dtor(&z_ret);
+        zval_dtor(z_ret);
+        efree(z_ret);
         RETURN_FALSE;
     }
 }
@@ -2067,7 +2069,7 @@ PHP_METHOD(RedisCluster, watch) {
     ht_dist = cluster_dist_create();
 
     // Allocate args, and grab them
-    z_args = emalloc(sizeof(zval*)*argc);
+    z_args = emalloc(sizeof(*z_args) * argc);
     if(zend_get_parameters_array(ht, argc, z_args)==FAILURE) {
         efree(z_args);
         cluster_dist_free(ht_dist);
@@ -2339,10 +2341,8 @@ static void cluster_raw_cmd(INTERNAL_FUNCTION_PARAMETERS, char *kw, int kw_len)
         RETURN_FALSE;
     }
 
-    /* Allocate an array to process arguments */
-    z_args = emalloc(argc * sizeof(zval*));
-
     /* Grab args */
+    z_args = emalloc(sizeof(*z_args) * argc);
     if(zend_get_parameters_array(ht, argc, z_args)==FAILURE) {
         efree(z_args);
         RETURN_FALSE;
