Segmentation fault when hiredisSetAllocators by jemalloc

[throwbear]

hiredis：1.2.0
I set memory allocator with jemalloc by hiredis.hiredisAllocFuncs. the code is as follow:

hiredisAllocFuncs myfuncs = {
.mallocFn = je_malloc,
.callocFn = je_calloc,
.reallocFn = je_realloc,
.strdupFn = strdup,
.freeFn = je_free,
};
hiredisAllocFuncs orig = hiredisSetAllocators(&myfuncs);

compile and run it. core dumped
gdb bt

Program received signal SIGSEGV, Segmentation fault.
rtree_metadata_read (rtree=, key=93824994342512, rtree_ctx=0x7ffff7fe38e8, tsdn=0x7ffff7fe3738) at include/jemalloc/internal/rtree.h:446
446 return rtree_leaf_elm_read(tsdn, rtree, elm,
(gdb) bt
#0 rtree_metadata_read (rtree=, key=93824994342512, rtree_ctx=0x7ffff7fe38e8, tsdn=0x7ffff7fe3738) at include/jemalloc/internal/rtree.h:446
#1 emap_alloc_ctx_lookup (alloc_ctx=, ptr=0x555555757670, emap=, tsdn=) at include/jemalloc/internal/emap.h:238
#2 ifree (slow_path=false, tcache=, ptr=0x555555757670, tsd=0x7ffff7fe3738) at src/jemalloc.c:2877
#3 je_free_default (ptr=0x555555757670) at src/jemalloc.c:3014
#4 0x00007ffff7bc3cbe in hi_free (ptr=0x555555757670) at /root/hiredis-cluster/build/_deps/hiredis/alloc.h:79
#5 0x00007ffff7bc58de in redisFree (c=0x7ffff6a08000) at /root/hiredis-cluster/build/_deps/hiredis/hiredis.c:740
#6 0x0000555555555029 in print_redis_operation (threadarg=0x7ffffff9c970) at rc_step_je.c:87
#7 0x00005555555553a0 in main (argc=1, argv=0x7fffffffe518) at rc_step_je.c:137

[michael-grunder]

You're overriding all of the allocation functions to the jemalloc variants but then using libc's strdup.

The program is crashing here:

hiredis/hiredis.c

Line 740 in 60e5075

hi_free(c->tcp.host);

Which is when hiredis is freeing a string duplicated with hi_strdup.

If jemalloc doesn't have je_strdup then just wrap it like so:

char *je_strdup(const char *s) {
    char *dup;
    size_t len;

    len = strlen(s);
    dup = je_malloc(len + 1);
    if (dup == NULL)
        return NULL;

    memcpy(dup, s, len);
    dup[len] = '\0';

    return dup;
}

hiredisAllocFuncs myfuncs = {
    .mallocFn = je_malloc,
    .callocFn = je_calloc,
    .reallocFn = je_realloc,
    .strdupFn = je_strdup,
    .freeFn = je_free,
};

[michael-grunder]

Going to close the issue since it's not a bug in hiredis but I'm happy to answer any further questions.