NotificationsYou must be signed in to change notification settings
Fork4.9k
Star17.8k

Commitd858994

committed

Fix use-after-free around DISTINCT transition function calls.

Have tuplesort_gettupleslot() copy the contents of its current table slotas needed. This is based on an approach taken by tuplestore_gettupleslot().In the future, tuplesort_gettupleslot() may also be taught to avoid copyingthe tuple where caller can determine that that is safe (thetuplestore_gettupleslot() interface already offers this option to callers).Patch by Peter Geoghegan. Fixes bug #14344, reported by Regina Obe.Report: <20160929035538.20224.39628@wrigleys.postgresql.org>Backpatch-through: 9.6

1 parent9e083fd commitd858994Copy full SHA for d858994

File tree

1 file changed

-0

lines changed

src/backend/utils/sort
- tuplesort.c

1 file changed

-0

lines changed

`‎src/backend/utils/sort/tuplesort.c`

Lines changed: 9 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -2084,6 +2084,10 @@ tuplesort_gettuple_common(Tuplesortstate *state, bool forward,`
`2084`	`2084`	`* determination of "non-equal tuple" based on simple binary inequality. A`
`2085`	`2085`	`* NULL value in leading attribute will set abbreviated value to zeroed`
`2086`	`2086`	`* representation, which caller may rely on in abbreviated inequality check.`
	`2087`	`+ *`
	`2088`	`+ * The slot receives a copied tuple (sometimes allocated in caller memory`
	`2089`	`+ * context) that will stay valid regardless of future manipulations of the`
	`2090`	`+ * tuplesort's state.`
`2087`	`2091`	`*/`
`2088`	`2092`	`bool`
`2089`	`2093`	`tuplesort_gettupleslot(Tuplesortstate*state,boolforward,`
`@@ -2104,6 +2108,11 @@ tuplesort_gettupleslot(Tuplesortstate *state, bool forward,`
`2104`	`2108`	`if (state->sortKeys->abbrev_converter&&abbrev)`
`2105`	`2109`	`*abbrev=stup.datum1;`
`2106`	`2110`
	`2111`	`+if (!should_free)`
	`2112`	`+{`
	`2113`	`+stup.tuple=heap_copy_minimal_tuple((MinimalTuple)stup.tuple);`
	`2114`	`+should_free= true;`
	`2115`	`+}`
`2107`	`2116`	`ExecStoreMinimalTuple((MinimalTuple)stup.tuple,slot,should_free);`
`2108`	`2117`	`return true;`
`2109`	`2118`	`}`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commitd858994

File tree

1 file changed

1 file changed

`‎src/backend/utils/sort/tuplesort.c`

0 commit comments