Avoid possible use-after-free when updating last fetched offset

mtabebe · May 18, 2016 · 8fcea73 · 8fcea73
1 parent a5e7be8
commit 8fcea73
Showing 1 changed file with 6 additions and 2 deletions.
diff --git a/src/rdkafka_broker.c b/src/rdkafka_broker.c
@@ -3456,21 +3456,25 @@ rd_kafka_fetch_reply_handle (rd_kafka_broker_t *rkb,
 			if (rd_kafka_q_len(&tmp_opq) > 0) {
 				/* Update partitions fetch offset based on
 				 * last message's offest. */
+				int64_t last_offset = -1;
 				rd_kafka_op_t *rko =
 					rd_kafka_q_last(&tmp_opq,
 							RD_KAFKA_OP_FETCH,
 							0 /* no error ops */);
 
+				if (rko)
+					last_offset = rko->rko_offset;
+
 				if (rd_kafka_q_concat(&rktp->rktp_fetchq,
 						      &tmp_opq) == -1) {
 					/* rktp fetchq disabled, probably
 					 * shutting down. Drop messages. */
 					rd_kafka_q_purge0(&tmp_opq,
 							  0/*no-lock*/);
 				} else {
-					if (rko)
+					if (last_offset != -1)
 						rktp->rktp_offsets.fetch_offset =
-							rko->rko_offset + 1;
+							last_offset + 1;
 					rd_atomic64_add(&rktp->rktp_c.msgs,
 							rd_kafka_q_len(&tmp_opq));
 				}