Re: Possible bug in plpgsql/src/gram.y - Mailing list pgsql-hackers

Confirmed.  I found a second problem in the file too, very similar.
Patch applied.

> In this bit of code in src/pl/plpgsql/src/gram.y in the current CVS
> sources, curname_def is defined as PLpgSQL_expr * but it is is
> allocated the space required for a PLpgSQL_var.  This looks like a
> bug.
>
> Ian
>
>                 | decl_varname K_CURSOR decl_cursor_args decl_is_from K_SELECT decl_cursor_query
>                     {
>                         PLpgSQL_var *new;
>                         PLpgSQL_expr *curname_def;
>                         char        buf[1024];
>                         char        *cp1;
>                         char        *cp2;
>
>                         plpgsql_ns_pop();
>
>                         new = malloc(sizeof(PLpgSQL_var));
>                         memset(new, 0, sizeof(PLpgSQL_var));
>
>                         curname_def = malloc(sizeof(PLpgSQL_var));
>                         memset(curname_def, 0, sizeof(PLpgSQL_var));
>
> ---------------------------(end of broadcast)---------------------------
> TIP 3: if posting/reading through Usenet, please send an appropriate
> subscribe-nomail command to majordomo@postgresql.org so that your
> message can get through to the mailing list cleanly
>

--
  Bruce Momjian                        |  http://candle.pha.pa.us
  pgman@candle.pha.pa.us               |  (610) 853-3000
  +  If your life is a hard drive,     |  830 Blythe Avenue
  +  Christ can be your backup.        |  Drexel Hill, Pennsylvania 19026
Index: src/pl/plpgsql/src/gram.y
===================================================================
RCS file: /home/projects/pgsql/cvsroot/pgsql/src/pl/plpgsql/src/gram.y,v
retrieving revision 1.22
diff -c -r1.22 gram.y
*** src/pl/plpgsql/src/gram.y    2001/07/11 18:54:18    1.22
--- src/pl/plpgsql/src/gram.y    2001/07/12 01:15:05
***************
*** 332,338 ****
                      {
                          PLpgSQL_rec        *new;

!                         new = malloc(sizeof(PLpgSQL_var));

                          new->dtype        = PLPGSQL_DTYPE_REC;
                          new->refname    = $1.name;
--- 332,338 ----
                      {
                          PLpgSQL_rec        *new;

!                         new = malloc(sizeof(PLpgSQL_rec));

                          new->dtype        = PLPGSQL_DTYPE_REC;
                          new->refname    = $1.name;
***************
*** 374,381 ****
                          new = malloc(sizeof(PLpgSQL_var));
                          memset(new, 0, sizeof(PLpgSQL_var));

!                         curname_def = malloc(sizeof(PLpgSQL_var));
!                         memset(curname_def, 0, sizeof(PLpgSQL_var));

                          new->dtype        = PLPGSQL_DTYPE_VAR;
                          new->refname    = $1.name;
--- 374,381 ----
                          new = malloc(sizeof(PLpgSQL_var));
                          memset(new, 0, sizeof(PLpgSQL_var));

!                         curname_def = malloc(sizeof(PLpgSQL_expr));
!                         memset(curname_def, 0, sizeof(PLpgSQL_expr));

                          new->dtype        = PLPGSQL_DTYPE_VAR;
                          new->refname    = $1.name;