diff options
| author | Andres Freund <andres@anarazel.de> | 2022-03-23 16:38:43 -0700 |
|---|---|---|
| committer | Andres Freund <andres@anarazel.de> | 2022-03-27 18:15:10 -0700 |
| commit | 6839aa7a6921d133a51e6162b9ee710ab712293d (patch) | |
| tree | efa6b3aeb91de01763a06bbdb77a4037e73bb816 | |
| parent | 3f7a59c59b4873a3b39838401d590f9d030a3500 (diff) | |
| download | postgresql-6839aa7a6921d133a51e6162b9ee710ab712293d.tar.gz postgresql-6839aa7a6921d133a51e6162b9ee710ab712293d.zip | |
waldump: fix use-after-free in search_directory().
After closedir() dirent->d_name is not valid anymore. As there alerady are a
few places relying on the limited lifetime of pg_waldump, do so here as well,
and just pg_strdup() the string.
The bug was introduced in fc49e24fa69a.
Found by UBSan, run locally.
Backpatch: 11-, like fc49e24fa69 itself.
| -rw-r--r-- | src/bin/pg_waldump/pg_waldump.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/bin/pg_waldump/pg_waldump.c b/src/bin/pg_waldump/pg_waldump.c index a8cf58e35f5..2daed328e7d 100644 --- a/src/bin/pg_waldump/pg_waldump.c +++ b/src/bin/pg_waldump/pg_waldump.c @@ -177,7 +177,7 @@ search_directory(const char *directory, const char *fname) if (IsXLogFileName(xlde->d_name)) { fd = open_file_in_directory(directory, xlde->d_name); - fname = xlde->d_name; + fname = pg_strdup(xlde->d_name); break; } } |