From c039dd784ca6139314880631de162f65dda25d45 Mon Sep 17 00:00:00 2001
From: Lazizbek Ergashev <lazerg2@gmail.com>
Date: Sat, 24 Oct 2026 07:42:58 +0500
Subject: [PATCH] Fix double free of reply in redis-cli --cluster add-node
 (#16053)

Fixes #16051

After the function sync step, `clusterManagerCommandAddNode()` frees
`reply` but doesn't clear the pointer. If resolving the first node's
address for `CLUSTER MEET` then fails, the `goto cleanup` frees the same
reply again. The pointer is now set to NULL after the free, so cleanup
skips it.
---
 src/redis-cli.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/redis-cli.c b/src/redis-cli.c
index 91c284d45a..460750b4b0 100644
--- a/src/redis-cli.c
+++ b/src/redis-cli.c
@@ -7762,7 +7762,10 @@ static int clusterManagerCommandAddNode(int argc, char **argv) {
         }
     }
 
-    if (reply) freeReplyObject(reply);
+    if (reply) {
+        freeReplyObject(reply);
+        reply = NULL;
+    }
 
     // Send CLUSTER MEET command to the new node
     clusterManagerLogInfo(">>> Send CLUSTER MEET to node %s:%d to make it "