Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit7ae4e78

Browse files
committed
Fix oversight in handling of modifiedCols sincef245236
Commitf245236 fixed a memory leak by moving the modifiedCols bitmapinto the per-row memory context. In the case of AFTER UPDATE triggers,the bitmap is however referenced from an event kept until the end of thequery, resulting in a use-after-free bug.Fixed by copying the bitmap into the AfterTriggerEvents memory context,which is the one where we keep the trigger events. There's only oneplace that needs to do the copy, but the memory context may not existyet. Doing that in a separate function seems more readable.Report by Alexander Pyhalov, fix by me. Backpatch to 13, where thebitmap was added to the event by commit71d60e2.Reported-by: Alexander PyhalovBackpatch-through: 13Discussion:https://postgr.es/m/acddb17c89b0d6cb940eaeda18c08bbe@postgrespro.ru
1 parent0c5fe4f commit7ae4e78

File tree

1 file changed

+32
-1
lines changed

1 file changed

+32
-1
lines changed

‎src/backend/commands/trigger.c

Lines changed: 32 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4070,6 +4070,37 @@ afterTriggerCheckState(AfterTriggerShared evtshared)
40704070
return ((evtshared->ats_event&AFTER_TRIGGER_INITDEFERRED)!=0);
40714071
}
40724072

4073+
/* ----------
4074+
* afterTriggerCopyBitmap()
4075+
*
4076+
* Copy bitmap into AfterTriggerEvents memory context, which is where the after
4077+
* trigger events are kept.
4078+
* ----------
4079+
*/
4080+
staticBitmapset*
4081+
afterTriggerCopyBitmap(Bitmapset*src)
4082+
{
4083+
Bitmapset*dst;
4084+
MemoryContextoldcxt;
4085+
4086+
if (src==NULL)
4087+
returnNULL;
4088+
4089+
/* Create event context if we didn't already */
4090+
if (afterTriggers.event_cxt==NULL)
4091+
afterTriggers.event_cxt=
4092+
AllocSetContextCreate(TopTransactionContext,
4093+
"AfterTriggerEvents",
4094+
ALLOCSET_DEFAULT_SIZES);
4095+
4096+
oldcxt=MemoryContextSwitchTo(afterTriggers.event_cxt);
4097+
4098+
dst=bms_copy(src);
4099+
4100+
MemoryContextSwitchTo(oldcxt);
4101+
4102+
returndst;
4103+
}
40734104

40744105
/* ----------
40754106
* afterTriggerAddEvent()
@@ -6481,7 +6512,7 @@ AfterTriggerSaveEvent(EState *estate, ResultRelInfo *relinfo,
64816512
new_shared.ats_table=transition_capture->tcs_private;
64826513
else
64836514
new_shared.ats_table=NULL;
6484-
new_shared.ats_modifiedcols=modifiedCols;
6515+
new_shared.ats_modifiedcols=afterTriggerCopyBitmap(modifiedCols);
64856516

64866517
afterTriggerAddEvent(&afterTriggers.query_stack[afterTriggers.query_depth].events,
64876518
&new_event,&new_shared);

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp