From 121796f792c4d8fdc06fe664d675ec16791f6818 Mon Sep 17 00:00:00 2001
From: root <root@yserv.com>
Date: Wed, 4 Nov 2009 11:59:27 +0100
Subject: [PATCH] fixed a refcounting bug with SORT ... STORE leading to random
 crashes

---
 dict.c  | 9 ++++++---
 redis.c | 4 +++-
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/dict.c b/dict.c
index 7f05e3f50..6e410b753 100644
--- a/dict.c
+++ b/dict.c
@@ -226,7 +226,10 @@ int dictAdd(dict *ht, void *key, void *val)
     return DICT_OK;
 }
 
-/* Add an element, discarding the old if the key already exists */
+/* Add an element, discarding the old if the key already exists.
+ * Return 1 if the key was added from scratch, 0 if there was already an
+ * element with such key and dictReplace() just performed a value update
+ * operation. */
 int dictReplace(dict *ht, void *key, void *val)
 {
     dictEntry *entry;
@@ -234,13 +237,13 @@ int dictReplace(dict *ht, void *key, void *val)
     /* Try to add the element. If the key
      * does not exists dictAdd will suceed. */
     if (dictAdd(ht, key, val) == DICT_OK)
-        return DICT_OK;
+        return 1;
     /* It already exists, get the entry */
     entry = dictFind(ht, key);
     /* Free the old value and set the new one */
     dictFreeEntryVal(ht, entry);
     dictSetHashVal(ht, entry, val);
-    return DICT_OK;
+    return 0;
 }
 
 /* Search and remove an element */
diff --git a/redis.c b/redis.c
index 21098e56d..48ad6287f 100644
--- a/redis.c
+++ b/redis.c
@@ -4664,7 +4664,9 @@ static void sortCommand(redisClient *c) {
                 }
             }
         }
-        dictReplace(c->db->dict,storekey,listObject);
+        if (dictReplace(c->db->dict,storekey,listObject)) {
+            incrRefCount(storekey);
+        }
         /* Note: we add 1 because the DB is dirty anyway since even if the
          * SORT result is empty a new key is set and maybe the old content
          * replaced. */