ziplistNext should work as expected when called with a pointer to ZIP_END

diff --git a/ziplist.c b/ziplist.c
index 8b96d6d72491396c7bb7be7adf243701818ff36c..433032e6939008f26ff521192a2cc8db86aa4813 100644 (file)
--- a/ziplist.c
+++ b/ziplist.c
@@ -430,7 +430,16 @@ unsigned char *ziplistIndex(unsigned char *zl, int index) {
 /* Return pointer to next entry in ziplist. */
 unsigned char *ziplistNext(unsigned char *zl, unsigned char *p) {
     ((void) zl);
-    return (p[0] == ZIP_END) ? NULL : p+zipRawEntryLength(p);
+
+    /* "p" could be equal to ZIP_END, caused by ziplistDelete,
+     * and we should return NULL. Otherwise, we should return NULL
+     * when the *next* element is ZIP_END (there is no next entry). */
+    if (p[0] == ZIP_END) {
+        return NULL;
+    } else {
+        p = p+zipRawEntryLength(p);
+        return (p[0] == ZIP_END) ? NULL : p;
+    }
 }
 
 /* Return pointer to previous entry in ziplist. */