Null pointer dereferencing in dict.c and async.c

[shouc]

The following code never aborts when malloc is unsuccessful, causing dereferencing of null pointers.

async.c:61

redisCallback *dup = malloc(sizeof(*dup));
memcpy(dup,src,sizeof(*dup)); // dup may be null
return dup;

dict.c:75

dict *ht = malloc(sizeof(*ht));
_dictInit(ht,type,privDataPtr); // ht may be null

dict.c:146

entry = malloc(sizeof(*entry));
entry->next = ht->table[index]; // entry may be null

dict.c:261

dictIterator *iter = malloc(sizeof(*iter));
iter->ht = ht; // iter may be null

[lamby]

This has been given the CVE ID CVE-2020-7105.

[michael-grunder]

We have an open PR that has this specific change in it along with a few other NULL pointer deref fixes although it does not immediately abort on failure to reallocate.

Just adding it here for reference.

[shouc]

fixed in #752 & #638, more is specified in #751

[lamby]

Shall we close #752 as well then? I'm a little lost, especially as #638 has a bunch of other changes that will be very difficult to backport to older, released, versions of hiredis.

[michael-grunder]

Apologies, I wasn't trying to confuse the situation. I just wanted to mention that #638 contains the same change (in addition to many more changes).

Merging #752 now and then #638 later seems reasonable to me.

[shouc]

#752 contains more fixes on nullptr dereferencing so I also think merging these two is reasonable