Double clean up leads to accessing invalid memory

[Martin C. Martin]

From get.cc around line 560:

        if (memcached_io_write(instance) == false)
        {
          memcached_instance_response_reset(instance);
          memcached_io_reset(instance);
          rc= MEMCACHED_SOME_ERRORS;
        }

        if (memcached_io_write(instance, request.bytes,
                               sizeof(request.bytes), true) == -1)
        {
          memcached_instance_response_reset(instance);
          memcached_io_reset(instance);
          rc= MEMCACHED_SOME_ERRORS;
        }

If both memcached_io_writes fail, we call the reset functions twice, and the second resets result in invalid accesses, according to valgrind. I think we even got a crash later.

[Martin C. Martin (martin-b69y0hv8h)]

BTW, suggested fix is to add an "else" before the second "if".

[Hassan El Jacifi (waver)]

Hi Folks,

Can we also have the same fix on precise libmemcached6 -> 0.44-1.1build1 ?

Thanks