database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-12 21:01:52 +03:00
Code Activity

Repair double-free in SP-GIST rescan (bug #15378)

Browse Source 
spgrescan would first reset traversalCxt, and then traverse a
potentially non-empty stack containing pointers to traversalValues
which had been allocated in those contexts, freeing them a second
time. This bug originates in commit ccd6eb49a where traversalValue was
introduced.

Repair by traversing the stack before the context reset; this isn't
ideal, since it means doing retail pfree in a context that's about to
be reset, but the freeing of a stack entry is also done in other
places in the code during the scan so it's not worth trying to
refactor it further. Regression test added.

Backpatch to 9.6 where the problem was introduced.

Per bug #15378; analysis and patch by me, originally from a report on
IRC by user velix; see also PostGIS ticket #4174; review by Alexander
Korotkov.

Discussion: https://postgr.es/m/153663176628.23136.11901365223750051490@wrigleys.postgresql.org
This commit is contained in:
Andrew Gierth
2018-09-11 18:14:19 +01:00
parent 4fa3741d1c
commit 500d49794f
3 changed files with 40 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/backend/access/spgist/spgscan.c
View File

@ -74,6 +74,13 @@ resetSpGistScanOpaque(SpGistScanOpaque so)
freeScanStack(so);
/*
* clear traversal context before proceeding to the next scan; this must
* not happen before the freeScanStack above, else we get double-free
* crashes.
*/
MemoryContextReset(so->traversalCxt);
if (so->searchNulls)
{
/* Stack a work item to scan the null index entries */
@ -212,9 +219,6 @@ spgrescan(IndexScanDesc scan, ScanKey scankey, int nscankeys,
{
SpGistScanOpaque so = (SpGistScanOpaque) scan->opaque;
/* clear traversal context before proceeding to the next scan */
MemoryContextReset(so->traversalCxt);
/* copy scankeys into local storage */
if (scankey && scan->numberOfKeys > 0)
{