i_stream_get_error() return value may point to memory allocated from
istream. redis_disconnected() calls connection_disconnect(), which frees
this memory. The error is still used, but now it's corrupted.
redis_disconnected(struct redis_connection *conn, const char *reason)
{
const struct dict_commit_result result = {
- DICT_COMMIT_RET_FAILED, reason
+ DICT_COMMIT_RET_FAILED,
+ /* t_strdup() in case reason points to istream, which gets
+ freed by connection_disconnect() */
+ t_strdup(reason)
};
const struct redis_dict_reply *reply;