From 140d1b70994971703fdb32b4dfef4dac3efa2ab9 Mon Sep 17 00:00:00 2001
From: Hristo Staykov <hristo.staykov@redis.com>
Date: Tue, 26 May 2026 19:04:13 +0300
Subject: [PATCH] Assert dictAdd success in pubsubRekeySubscriptionsForACLLoad

A failed insert would silently leak the pubsubUserSubs value and
drop provenance tracking, since the old dict's destructors are
disabled before release. Assert DICT_OK to catch duplicates early,
matching the style used in the subscribe path.
---
 src/pubsub.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/pubsub.c b/src/pubsub.c
index c60159d8b..58008540d 100644
--- a/src/pubsub.c
+++ b/src/pubsub.c
@@ -981,11 +981,11 @@ void pubsubRekeySubscriptionsForACLLoad(client *c) {
 
         if (pubsubUserIsNoAuth(old_user_ptr)) {
             /* Sentinel key is a stable static pointer — carry it as-is. */
-            dictAdd(new_dict, old_user_ptr, subs);
+            serverAssert(dictAdd(new_dict, old_user_ptr, subs) == DICT_OK);
         } else {
             user *new_user = ACLGetUserByName(old_user_ptr->name, sdslen(old_user_ptr->name));
             serverAssert(new_user != NULL);
-            dictAdd(new_dict, new_user, subs);
+            serverAssert(dictAdd(new_dict, new_user, subs) == DICT_OK);
         }
     }
     dictResetIterator(&di);