NotificationsYou must be signed in to change notification settings
Fork6
Star31

Commita5f0bd7

committed

Fix use-after-free around DISTINCT transition function calls.

Have tuplesort_gettupleslot() copy the contents of its current table slotas needed. This is based on an approach taken by tuplestore_gettupleslot().In the future, tuplesort_gettupleslot() may also be taught to avoid copyingthe tuple where caller can determine that that is safe (thetuplestore_gettupleslot() interface already offers this option to callers).Patch by Peter Geoghegan. Fixes bug #14344, reported by Regina Obe.Report: <20160929035538.20224.39628@wrigleys.postgresql.org>Backpatch-through: 9.6

1 parentdb4b54f commita5f0bd7Copy full SHA for a5f0bd7

File tree

1 file changed

-0

lines changed

src/backend/utils/sort
- tuplesort.c

1 file changed

-0

lines changed

`‎src/backend/utils/sort/tuplesort.c`

Lines changed: 9 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -2045,6 +2045,10 @@ tuplesort_gettuple_common(Tuplesortstate *state, bool forward,`
`2045`	`2045`	`* determination of "non-equal tuple" based on simple binary inequality. A`
`2046`	`2046`	`* NULL value in leading attribute will set abbreviated value to zeroed`
`2047`	`2047`	`* representation, which caller may rely on in abbreviated inequality check.`
	`2048`	`+ *`
	`2049`	`+ * The slot receives a copied tuple (sometimes allocated in caller memory`
	`2050`	`+ * context) that will stay valid regardless of future manipulations of the`
	`2051`	`+ * tuplesort's state.`
`2048`	`2052`	`*/`
`2049`	`2053`	`bool`
`2050`	`2054`	`tuplesort_gettupleslot(Tuplesortstate*state,boolforward,`
`@@ -2065,6 +2069,11 @@ tuplesort_gettupleslot(Tuplesortstate *state, bool forward,`
`2065`	`2069`	`if (state->sortKeys->abbrev_converter&&abbrev)`
`2066`	`2070`	`*abbrev=stup.datum1;`
`2067`	`2071`
	`2072`	`+if (!should_free)`
	`2073`	`+{`
	`2074`	`+stup.tuple=heap_copy_minimal_tuple((MinimalTuple)stup.tuple);`
	`2075`	`+should_free= true;`
	`2076`	`+}`
`2068`	`2077`	`ExecStoreMinimalTuple((MinimalTuple)stup.tuple,slot,should_free);`
`2069`	`2078`	`return true;`
`2070`	`2079`	`}`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commita5f0bd7

File tree

1 file changed

1 file changed

`‎src/backend/utils/sort/tuplesort.c`

0 commit comments