Fix some simple leaks in RedisArray

* Make sure we always free our allocated key when extracting
* Don't copy z_fun and z_dist twice and only free one
* Free outer array for z_zadd_args

1 files changed, 11 insertions, 15 deletions

diff --git a/redis_array_impl.c b/redis_array_impl.c
index e21bcbb1..9d71eddf 100644
--- a/redis_array_impl.c
+++ b/redis_array_impl.c
@@ -348,19 +348,9 @@ ra_make_array(HashTable *hosts, zval *z_fun, zval *z_dist, HashTable *hosts_prev
 	}
 	ra->prev = hosts_prev ? ra_make_array(hosts_prev, z_fun, z_dist, NULL, b_index, b_pconnect, retry_interval, b_lazy_connect, connect_timeout TSRMLS_CC) : NULL;
 
-	/* copy function if provided */
-	if(z_fun) {
-		MAKE_STD_ZVAL(ra->z_fun);
-		*ra->z_fun = *z_fun;
-		zval_copy_ctor(ra->z_fun);
-	}
-
-	/* copy distributor if provided */
-	if(z_dist) {
-		MAKE_STD_ZVAL(ra->z_dist);
-		*ra->z_dist = *z_dist;
-		zval_copy_ctor(ra->z_dist);
-	}
+    /* Set hash function and distribtor if provided */
+    ra->z_fun = z_fun;
+    ra->z_dist = z_dist;
 
 	return ra;
 }
@@ -471,7 +461,8 @@ ra_find_node(RedisArray *ra, const char *key, int key_len, int *out_pos TSRMLS_D
 
         if(ra->z_dist) {
                 if (!ra_call_distributor(ra, key, key_len, &pos TSRMLS_CC)) {
-                        return NULL;
+                    efree(out);
+                    return NULL;
                 }
         }
         else {
@@ -479,7 +470,6 @@ ra_find_node(RedisArray *ra, const char *key, int key_len, int *out_pos TSRMLS_D
 
                 /* hash */
                 hash = rcrc32(out, out_len);
-                efree(out);
 
                 /* get position on ring */
                 h64 = hash;
@@ -489,6 +479,9 @@ ra_find_node(RedisArray *ra, const char *key, int key_len, int *out_pos TSRMLS_D
         }
         if(out_pos) *out_pos = pos;
 
+        /* cleanup */
+        efree(out);
+
         return ra->redis[pos];
 }
 
@@ -970,6 +963,9 @@ ra_move_zset(const char *key, int key_len, zval *z_from, zval *z_to, long ttl TS
 		efree(z_zadd_args[i]);
 	}
 
+    /* Free the array itself */
+    efree(z_zadd_args);
+
 	return 1;
 }