Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit8a81778

Browse files
committed
Fix two low-probability memory leaks in regular expression parsing.
If pg_regcomp failed after having invoked markst/cleanst, it would leak any"struct subre" nodes it had created. (We've already detected all regexsyntax errors at that point, so the only likely causes of later failurewould be query cancel or out-of-memory.) To fix, make sure freesrnodeknows the difference between the pre-cleanst and post-cleanst cleanupprocedures. Add some documentation of this less-than-obvious point.Also, newlacon did the wrong thing with an out-of-memory failure fromrealloc(), so that the previously allocated array would be leaked.Both of these are pretty low-probability scenarios, but a bug is a bug,so patch all the way back.Per bug #10976 from Arthur O'Dwyer.
1 parenta41dc73 commit8a81778

File tree

1 file changed

+24
-7
lines changed

1 file changed

+24
-7
lines changed

‎src/backend/regex/regcomp.c

Lines changed: 24 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1663,8 +1663,9 @@ freesrnode(struct vars * v,/* might be NULL */
16631663
freecnfa(&sr->cnfa);
16641664
sr->flags=0;
16651665

1666-
if (v!=NULL)
1666+
if (v!=NULL&&v->treechain!=NULL)
16671667
{
1668+
/* we're still parsing, maybe we can reuse the subre */
16681669
sr->left=v->treefree;
16691670
v->treefree=sr;
16701671
}
@@ -1710,6 +1711,20 @@ numst(struct subre * t,
17101711

17111712
/*
17121713
* markst - mark tree nodes as INUSE
1714+
*
1715+
* Note: this is a great deal more subtle than it looks. During initial
1716+
* parsing of a regex, all subres are linked into the treechain list;
1717+
* discarded ones are also linked into the treefree list for possible reuse.
1718+
* After we are done creating all subres required for a regex, we run markst()
1719+
* then cleanst(), which results in discarding all subres not reachable from
1720+
* v->tree. We then clear v->treechain, indicating that subres must be found
1721+
* by descending from v->tree. This changes the behavior of freesubre(): it
1722+
* will henceforth FREE() unwanted subres rather than sticking them into the
1723+
* treefree list. (Doing that any earlier would result in dangling links in
1724+
* the treechain list.) This all means that freev() will clean up correctly
1725+
* if invoked before or after markst()+cleanst(); but it would not work if
1726+
* called partway through this state conversion, so we mustn't error out
1727+
* in or between these two functions.
17131728
*/
17141729
staticvoid
17151730
markst(structsubre*t)
@@ -1807,25 +1822,27 @@ newlacon(struct vars * v,
18071822
intpos)
18081823
{
18091824
intn;
1825+
structsubre*newlacons;
18101826
structsubre*sub;
18111827

18121828
if (v->nlacons==0)
18131829
{
1814-
v->lacons= (structsubre*)MALLOC(2*sizeof(structsubre));
18151830
n=1;/* skip 0th */
1816-
v->nlacons=2;
1831+
newlacons=(structsubre*)MALLOC(2*sizeof(structsubre));
18171832
}
18181833
else
18191834
{
1820-
v->lacons=(structsubre*)REALLOC(v->lacons,
1821-
(v->nlacons+1)*sizeof(structsubre));
1822-
n=v->nlacons++;
1835+
n=v->nlacons;
1836+
newlacons=(structsubre*)REALLOC(v->lacons,
1837+
(n+1)*sizeof(structsubre));
18231838
}
1824-
if (v->lacons==NULL)
1839+
if (newlacons==NULL)
18251840
{
18261841
ERR(REG_ESPACE);
18271842
return0;
18281843
}
1844+
v->lacons=newlacons;
1845+
v->nlacons=n+1;
18291846
sub=&v->lacons[n];
18301847
sub->begin=begin;
18311848
sub->end=end;

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp