database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-06-30 21:42:05 +03:00
Code Activity

Fix use-after-free bug with AfterTriggersTableData.storeslot

Browse Source 
AfterTriggerSaveEvent() wrongly allocates the slot in execution-span
memory context, whereas the correct thing is to allocate it in
a transaction-span context, because that's where the enclosing
AfterTriggersTableData instance belongs into.

Backpatch to 12 (the test back to 11, where it works well with no code
changes, and it's good to have to confirm that the case was previously
well supported); this bug seems introduced by commit ff11e7f4b9.

Reported-by: Bertrand Drouvot <bdrouvot@amazon.com>
Author: Amit Langote <amitlangote09@gmail.com>
Discussion: https://postgr.es/m/39a71864-b120-5a5c-8cc5-c632b6f16761@amazon.com
This commit is contained in:
Alvaro Herrera
2021-02-27 18:09:15 -03:00
parent 388b959315
commit 25936fd46c
3 changed files with 157 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

52
src/backend/commands/trigger.c
View File

@ -3536,6 +3536,8 @@ static void AfterTriggerExecute(EState *estate,
TupleTableSlot *trig_tuple_slot2);
static AfterTriggersTableData *GetAfterTriggersTableData(Oid relid,
CmdType cmdType);
static TupleTableSlot *GetAfterTriggersStoreSlot(AfterTriggersTableData *table,
TupleDesc tupdesc);
static void AfterTriggerFreeQuery(AfterTriggersQueryData *qs);
static SetConstraintState SetConstraintStateCreate(int numalloc);
static SetConstraintState SetConstraintStateCopy(SetConstraintState state);
@ -4336,6 +4338,31 @@ GetAfterTriggersTableData(Oid relid, CmdType cmdType)
return table;
}
/*
* Returns a TupleTableSlot suitable for holding the tuples to be put
* into AfterTriggersTableData's transition table tuplestores.
*/
static TupleTableSlot *
GetAfterTriggersStoreSlot(AfterTriggersTableData *table,
TupleDesc tupdesc)
{
/* Create it if not already done. */
if (!table->storeslot)
{
MemoryContext oldcxt;
/*
* We only need this slot only until AfterTriggerEndQuery, but making
* it last till end-of-subxact is good enough. It'll be freed by
* AfterTriggerFreeQuery().
*/
oldcxt = MemoryContextSwitchTo(CurTransactionContext);
table->storeslot = MakeSingleTupleTableSlot(tupdesc, &TTSOpsVirtual);
MemoryContextSwitchTo(oldcxt);
}
return table->storeslot;
}
/*
* MakeTransitionCaptureState
@ -4625,6 +4652,8 @@ AfterTriggerFreeQuery(AfterTriggersQueryData *qs)
table->new_tuplestore = NULL;
if (ts)
tuplestore_end(ts);
if (table->storeslot)
ExecDropSingleTupleTableSlot(table->storeslot);
}
/*
@ -5474,17 +5503,10 @@ AfterTriggerSaveEvent(EState *estate, ResultRelInfo *relinfo,
if (map != NULL)
{
AfterTriggersTableData *table = transition_capture->tcs_private;
TupleTableSlot *storeslot;
storeslot = transition_capture->tcs_private->storeslot;
if (!storeslot)
{
storeslot = ExecAllocTableSlot(&estate->es_tupleTable,
map->outdesc,
&TTSOpsVirtual);
transition_capture->tcs_private->storeslot = storeslot;
}
storeslot = GetAfterTriggersStoreSlot(table, map->outdesc);
execute_attr_map_slot(map->attrMap, oldslot, storeslot);
tuplestore_puttupleslot(old_tuplestore, storeslot);
}
@ -5504,18 +5526,10 @@ AfterTriggerSaveEvent(EState *estate, ResultRelInfo *relinfo,
original_insert_tuple);
else if (map != NULL)
{
AfterTriggersTableData *table = transition_capture->tcs_private;
TupleTableSlot *storeslot;
storeslot = transition_capture->tcs_private->storeslot;
if (!storeslot)
{
storeslot = ExecAllocTableSlot(&estate->es_tupleTable,
map->outdesc,
&TTSOpsVirtual);
transition_capture->tcs_private->storeslot = storeslot;
}
storeslot = GetAfterTriggersStoreSlot(table, map->outdesc);
execute_attr_map_slot(map->attrMap, newslot, storeslot);
tuplestore_puttupleslot(new_tuplestore, storeslot);
}