fixed a refcounting bug with SORT ... STORE leading to random crashes

diff --git a/dict.c b/dict.c
index 7f05e3f50ea28f902680d1bd9e6e76c4eb2a8e3f..6e410b75309e914e66c03ad8d7c46ea0e17e554c 100644 (file)
--- a/dict.c
+++ b/dict.c
@@ -226,7 +226,10 @@ int dictAdd(dict *ht, void *key, void *val)
     return DICT_OK;
 }
 
-/* Add an element, discarding the old if the key already exists */
+/* Add an element, discarding the old if the key already exists.
+ * Return 1 if the key was added from scratch, 0 if there was already an
+ * element with such key and dictReplace() just performed a value update
+ * operation. */
 int dictReplace(dict *ht, void *key, void *val)
 {
     dictEntry *entry;
@@ -234,13 +237,13 @@ int dictReplace(dict *ht, void *key, void *val)
     /* Try to add the element. If the key
      * does not exists dictAdd will suceed. */
     if (dictAdd(ht, key, val) == DICT_OK)
-        return DICT_OK;
+        return 1;
     /* It already exists, get the entry */
     entry = dictFind(ht, key);
     /* Free the old value and set the new one */
     dictFreeEntryVal(ht, entry);
     dictSetHashVal(ht, entry, val);
-    return DICT_OK;
+    return 0;
 }
 
 /* Search and remove an element */

diff --git a/redis.c b/redis.c
index 21098e56dab98f971bd90cdac40d90a6c28c906a..48ad6287f0d6cdb98df81e02d8bac1283fabe09d 100644 (file)
--- a/redis.c
+++ b/redis.c
@@ -4664,7 +4664,9 @@ static void sortCommand(redisClient *c) {
                 }
             }
         }
-        dictReplace(c->db->dict,storekey,listObject);
+        if (dictReplace(c->db->dict,storekey,listObject)) {
+            incrRefCount(storekey);
+        }
         /* Note: we add 1 because the DB is dirty anyway since even if the
          * SORT result is empty a new key is set and maybe the old content
          * replaced. */