Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit984c23f

Browse files
committed
Fix oversight in handling of modifiedCols sincef245236
Commitf245236 fixed a memory leak by moving the modifiedCols bitmapinto the per-row memory context. In the case of AFTER UPDATE triggers,the bitmap is however referenced from an event kept until the end of thequery, resulting in a use-after-free bug.Fixed by copying the bitmap into the AfterTriggerEvents memory context,which is the one where we keep the trigger events. There's only oneplace that needs to do the copy, but the memory context may not existyet. Doing that in a separate function seems more readable.Report by Alexander Pyhalov, fix by me. Backpatch to 13, where thebitmap was added to the event by commit71d60e2.Reported-by: Alexander PyhalovBackpatch-through: 13Discussion:https://postgr.es/m/acddb17c89b0d6cb940eaeda18c08bbe@postgrespro.ru
1 parent3ce761d commit984c23f

File tree

1 file changed

+32
-1
lines changed

1 file changed

+32
-1
lines changed

‎src/backend/commands/trigger.c

Lines changed: 32 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3610,6 +3610,37 @@ afterTriggerCheckState(AfterTriggerShared evtshared)
36103610
return ((evtshared->ats_event&AFTER_TRIGGER_INITDEFERRED)!=0);
36113611
}
36123612

3613+
/* ----------
3614+
* afterTriggerCopyBitmap()
3615+
*
3616+
* Copy bitmap into AfterTriggerEvents memory context, which is where the after
3617+
* trigger events are kept.
3618+
* ----------
3619+
*/
3620+
staticBitmapset*
3621+
afterTriggerCopyBitmap(Bitmapset*src)
3622+
{
3623+
Bitmapset*dst;
3624+
MemoryContextoldcxt;
3625+
3626+
if (src==NULL)
3627+
returnNULL;
3628+
3629+
/* Create event context if we didn't already */
3630+
if (afterTriggers.event_cxt==NULL)
3631+
afterTriggers.event_cxt=
3632+
AllocSetContextCreate(TopTransactionContext,
3633+
"AfterTriggerEvents",
3634+
ALLOCSET_DEFAULT_SIZES);
3635+
3636+
oldcxt=MemoryContextSwitchTo(afterTriggers.event_cxt);
3637+
3638+
dst=bms_copy(src);
3639+
3640+
MemoryContextSwitchTo(oldcxt);
3641+
3642+
returndst;
3643+
}
36133644

36143645
/* ----------
36153646
* afterTriggerAddEvent()
@@ -5726,7 +5757,7 @@ AfterTriggerSaveEvent(EState *estate, ResultRelInfo *relinfo,
57265757
new_shared.ats_table=transition_capture->tcs_private;
57275758
else
57285759
new_shared.ats_table=NULL;
5729-
new_shared.ats_modifiedcols=modifiedCols;
5760+
new_shared.ats_modifiedcols=afterTriggerCopyBitmap(modifiedCols);
57305761

57315762
afterTriggerAddEvent(&afterTriggers.query_stack[afterTriggers.query_depth].events,
57325763
&new_event,&new_shared);

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp