Commit7f6fa29

committed

Fix user-after-free bug.

Introduced by commitaea5d29.Patch from Amit Kapila. Issue discovered independently by Amit Kapilaand Ashutosh Sharma.

1 parente434ad3 commit7f6fa29Copy full SHA for 7f6fa29

File tree

-2

lines changed

-2

lines changed

Lines changed: 4 additions & 2 deletions

Original file line number	Diff line number	Diff line change
`@@ -440,12 +440,14 @@ ReportBackgroundWorkerExit(slist_mutable_iter *cur)`
`440`	`440`	`{`
`441`	`441`	`RegisteredBgWorker*rw;`
`442`	`442`	`BackgroundWorkerSlot*slot;`
	`443`	`+intnotify_pid;`
`443`	`444`
`444`	`445`	`rw=slist_container(RegisteredBgWorker,rw_lnode,cur->cur);`
`445`	`446`
`446`	`447`	`Assert(rw->rw_shmem_slot<max_worker_processes);`
`447`	`448`	`slot=&BackgroundWorkerData->slot[rw->rw_shmem_slot];`
`448`	`449`	`slot->pid=rw->rw_pid;`
	`450`	`+notify_pid=rw->rw_worker.bgw_notify_pid;`
`449`	`451`
`450`	`452`	`/*`
`451`	`453`	`* If this worker is slated for deregistration, do that before notifying`
`@@ -458,8 +460,8 @@ ReportBackgroundWorkerExit(slist_mutable_iter *cur)`
`458`	`460`	`rw->rw_worker.bgw_restart_time==BGW_NEVER_RESTART)`
`459`	`461`	`ForgetBackgroundWorker(cur);`
`460`	`462`
`461`		`-if (rw->rw_worker.bgw_notify_pid!=0)`
`462`		`-kill(rw->rw_worker.bgw_notify_pid,SIGUSR1);`
	`463`	`+if (notify_pid!=0)`
	`464`	`+kill(notify_pid,SIGUSR1);`
`463`	`465`	`}`
`464`	`466`
`465`	`467`	`/*`

Comments

(0)