diff options
| author | Tom Lane <tgl@sss.pgh.pa.us> | 2019-08-15 20:04:19 -0400 |
|---|---|---|
| committer | Tom Lane <tgl@sss.pgh.pa.us> | 2019-08-15 20:04:19 -0400 |
| commit | 60886965a271242c19e40483c82b41ff726ca24e (patch) | |
| tree | 25e8cafd732881999f97e6c3b80dd957cfbc377f /src/backend/commands | |
| parent | e3ddb112f245041565aa102e20234799e366caab (diff) | |
| download | postgresql-60886965a271242c19e40483c82b41ff726ca24e.tar.gz postgresql-60886965a271242c19e40483c82b41ff726ca24e.zip | |
Prevent possible double-free when update trigger returns old tuple.
This is a variant of the problem fixed in commit 25b692568, which
unfortunately we failed to detect at the time. If an update trigger
returns the "old" tuple, as it's entitled to do, then a subsequent
iteration of the loop in ExecBRUpdateTriggers would have "oldtuple"
equal to "trigtuple" and would fail to notice that it shouldn't
free that.
In addition to fixing the code, extend the test case added by
25b692568 so that it covers multiple-trigger-iterations cases.
This problem does not manifest in v12/HEAD, as a result of the
relevant code having been largely rewritten for slotification.
However, include the test case into v12/HEAD anyway, since this
is clearly an area that someone could break again in future.
Per report from Piotr Gabriel Kosinski. Back-patch into all
supported branches, since the bug seems quite old.
Diagnosis and code fix by Thomas Munro, test case by me.
Discussion: https://postgr.es/m/CAFMLSdP0rd7LqC3j-H6Fh51FYSt5A10DDh-3=W4PPc4LLUQ8YQ@mail.gmail.com
Diffstat (limited to 'src/backend/commands')
| -rw-r--r-- | src/backend/commands/trigger.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/src/backend/commands/trigger.c b/src/backend/commands/trigger.c index 039a1e31171..f8384062534 100644 --- a/src/backend/commands/trigger.c +++ b/src/backend/commands/trigger.c @@ -2806,7 +2806,9 @@ ExecBRUpdateTriggers(EState *estate, EPQState *epqstate, relinfo->ri_TrigFunctions, relinfo->ri_TrigInstrument, GetPerTupleMemoryContext(estate)); - if (oldtuple != newtuple && oldtuple != slottuple) + if (oldtuple != newtuple && + oldtuple != slottuple && + oldtuple != trigtuple) heap_freetuple(oldtuple); if (newtuple == NULL) { |