Fix for ZUNIONSTORE bug when there is an empty set among input sets. Regression test...

[redis.git] / src / t_zset.c

diff --git a/src/t_zset.c b/src/t_zset.c
index 8b1662091f1a0516efd1c9e0b5c05641fbbb5427..19aac3d50a3792cfa0bb4d0ce3839039466bde61 100644 (file)
--- a/src/t_zset.c
+++ b/src/t_zset.c
@@ -1521,6 +1521,8 @@ void zunionInterGenericCommand(redisClient *c, robj *dstkey, int op) {
 
                 score = src[0].weight * zval.score;
                 for (j = 1; j < setnum; j++) {
+                    /* It is not safe to access the hash we zset we are
+                     * iterating, so explicitly check for equal object. */
                     if (src[j].subject == src[0].subject) {
                         value = zval.score*src[j].weight;
                         zunionInterAggregate(&score,value,aggregate);
@@ -1548,7 +1550,7 @@ void zunionInterGenericCommand(redisClient *c, robj *dstkey, int op) {
         }
     } else if (op == REDIS_OP_UNION) {
         for (i = 0; i < setnum; i++) {
-            if (zuiLength(&src[0]) == 0)
+            if (zuiLength(&src[i]) == 0)
                 continue;
 
             while (zuiNext(&src[i],&zval)) {
@@ -1564,7 +1566,12 @@ void zunionInterGenericCommand(redisClient *c, robj *dstkey, int op) {
                 /* Because the inputs are sorted by size, it's only possible
                  * for sets at larger indices to hold this element. */
                 for (j = (i+1); j < setnum; j++) {
-                    if (zuiFind(&src[j],&zval,&value)) {
+                    /* It is not safe to access the hash we zset we are
+                     * iterating, so explicitly check for equal object. */
+                    if(src[j].subject == src[i].subject) {
+                        value = zval.score*src[j].weight;
+                        zunionInterAggregate(&score,value,aggregate);
+                    } else if (zuiFind(&src[j],&zval,&value)) {
                         value *= src[j].weight;
                         zunionInterAggregate(&score,value,aggregate);
                     }