From 7f532eacdf870387fdf72dc374cf9c7a6b70c2d9 Mon Sep 17 00:00:00 2001
From: nuyb <103496262+wlswo@users.noreply.github.com>
Date: Mon, 1 Jun 2026 22:27:35 +0900
Subject: [PATCH] Fix garbled "source node not found" error in atomic slot
 migration (#15284)

asmSyncWithSource() built the error with sdscatfmt() and a "%.40s"
specifier. sdscatfmt() is not printf: it parses only the single byte
after '%' and ignores width/precision, so "%.40s" emits a literal '.',
consumes no argument, and task->source is never printed. The message
rendered as "Source node .40s was not found", dropping the node name.

task->source is a CLUSTER_NAMELEN (40) byte, non-NUL-terminated buffer
(filled via memcpy and always read with an explicit length elsewhere),
so simply switching to sdscatfmt's "%s" would strlen() past the buffer.
Use sdscatprintf(), which honors the "%.40s" precision and bounds the
read to 40 bytes -- matching the sibling error paths in this function
that already use sdscatprintf().
---
 src/cluster_asm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/cluster_asm.c b/src/cluster_asm.c
index ac94a5103c..f38f52e11d 100644
--- a/src/cluster_asm.c
+++ b/src/cluster_asm.c
@@ -1628,7 +1628,7 @@ void asmSyncWithSource(connection *conn) {
         /* Create RDB channel connection */
         clusterNode *source_node = clusterLookupNode(task->source, CLUSTER_NAMELEN);
         if (!source_node) {
-            task_error_msg = sdscatfmt(sdsempty(), "Source node %.40s was not found", task->source);
+            task_error_msg = sdscatprintf(sdsempty(), "Source node %.40s was not found", task->source);
             goto error;
         }
         char *ip = clusterNodeIp(source_node);