mirrors/postgres
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix use-after-free around DISTINCT transition function calls.

Browse Source 
Have tuplesort_gettupleslot() copy the contents of its current table slot
as needed. This is based on an approach taken by tuplestore_gettupleslot().
In the future, tuplesort_gettupleslot() may also be taught to avoid copying
the tuple where caller can determine that that is safe (the
tuplestore_gettupleslot() interface already offers this option to callers).

Patch by Peter Geoghegan. Fixes bug #14344, reported by Regina Obe.

Report: <20160929035538.20224.39628@wrigleys.postgresql.org>

Backpatch-through: 9.6
This commit is contained in:
Heikki Linnakangas 2016-10-17 12:13:16 +03:00
parent 9e083fd468
commit d8589946dd
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/backend/utils/sort/tuplesort.c
View File

@ -2084,6 +2084,10 @@ tuplesort_gettuple_common(Tuplesortstate *state, bool forward,
* determination of "non-equal tuple" based on simple binary inequality. A * determination of "non-equal tuple" based on simple binary inequality. A
* NULL value in leading attribute will set abbreviated value to zeroed * NULL value in leading attribute will set abbreviated value to zeroed
* representation, which caller may rely on in abbreviated inequality check. * representation, which caller may rely on in abbreviated inequality check.
*
* The slot receives a copied tuple (sometimes allocated in caller memory
* context) that will stay valid regardless of future manipulations of the
* tuplesort's state.
*/ */
bool bool
tuplesort_gettupleslot(Tuplesortstate *state, bool forward, tuplesort_gettupleslot(Tuplesortstate *state, bool forward,
@ -2104,6 +2108,11 @@ tuplesort_gettupleslot(Tuplesortstate *state, bool forward,
if (state->sortKeys->abbrev_converter && abbrev) if (state->sortKeys->abbrev_converter && abbrev)
*abbrev = stup.datum1; *abbrev = stup.datum1;
if (!should_free)
{
stup.tuple = heap_copy_minimal_tuple((MinimalTuple) stup.tuple);
should_free = true;
}
ExecStoreMinimalTuple((MinimalTuple) stup.tuple, slot, should_free); ExecStoreMinimalTuple((MinimalTuple) stup.tuple, slot, should_free);
return true; return true;
} }