NotificationsYou must be signed in to change notification settings
Fork6
Star31

Commit75e03ea

committed

Fix potential use-after-free for BEFORE UPDATE row triggers on non-core AMs.

When such a trigger returns the old row version, it naturally getstored in the slot for the trigger result. When a table AMs doesn'tstore HeapTuples internally, ExecBRUpdateTriggers() frees the old rowversion passed to triggers - but before this fix it might still bereferenced by the slot holding the new tuple.Noticed when running the out-of-core zheap AM against the in-coreversion of tableam.Author: Andres Freund

1 parentbb385c4 commit75e03eaCopy full SHA for 75e03ea

File tree

1 file changed

-0

lines changed

src/backend/commands
- trigger.c

1 file changed

-0

lines changed

`‎src/backend/commands/trigger.c`

Lines changed: 9 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -3109,6 +3109,15 @@ ExecBRUpdateTriggers(EState estate, EPQState epqstate,`
`3109`	`3109`	`{`
`3110`	`3110`	`ExecForceStoreHeapTuple(newtuple,newslot);`
`3111`	`3111`
	`3112`	`+/*`
	`3113`	`+ * If the tuple returned by the trigger / being stored, is the old`
	`3114`	`+ * row version, and the heap tuple passed to the trigger was`
	`3115`	`+ * allocated locally, materialize the slot. Otherwise we might`
	`3116`	`+ * free it while still referenced by the slot.`
	`3117`	`+ */`
	`3118`	`+if (should_free_trig&&newtuple==trigtuple)`
	`3119`	`+ExecMaterializeSlot(newslot);`
	`3120`	`+`
`3112`	`3121`	`if (should_free_new)`
`3113`	`3122`	`heap_freetuple(oldtuple);`
`3114`	`3123`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commit75e03ea

File tree

1 file changed

1 file changed

`‎src/backend/commands/trigger.c`

0 commit comments