[2.8] Fix NULL related bugs [MOD-6337, MOD-6336] (#4288)

* fix index error uninitialized free * fix potential bull dereference
RediSearch · Dec 28, 2023 · 09cdeb7 · 09cdeb7
1 parent 84e200f
commit 09cdeb7
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 3 deletions.
diff --git a/coord/src/dist_aggregate.c b/coord/src/dist_aggregate.c
@@ -396,7 +396,7 @@ static int rpnetNext(ResultProcessor *self, SearchResult *r) {
     }
 
     // If an error was returned, propagate it
-    if(MRReply_Type(nc->current.root) == MR_REPLY_ERROR) {
+    if (nc->current.root && MRReply_Type(nc->current.root) == MR_REPLY_ERROR) {
       const char *strErr = MRReply_String(nc->current.root, NULL);
       if (!strErr
           || strcmp(strErr, "Timeout limit was reached")

diff --git a/src/spec.c b/src/spec.c
@@ -2411,6 +2411,9 @@ int IndexSpec_CreateFromRdb(RedisModuleCtx *ctx, RedisModuleIO *rdb, int encver,
 
   sp->scan_in_progress = false;
 
+  // `indexError` must be initialized before attempting to free the spec
+  sp->stats.indexError = IndexError_Init();
+
   RefManager *oldSpec = dictFetchValue(specDict_g, sp->name);
   if (oldSpec) {
     // spec already exists lets just free this one
@@ -2428,8 +2431,6 @@ int IndexSpec_CreateFromRdb(RedisModuleCtx *ctx, RedisModuleIO *rdb, int encver,
     dictAdd(specDict_g, sp->name, spec_ref.rm);
   }
 
-  sp->stats.indexError = IndexError_Init();
-
   for (int i = 0; i < sp->numFields; i++) {
     FieldsGlobalStats_UpdateStats(sp->fields + i, 1);
   }