Postgres Pro
Downloads
Home   >   mailing lists

Report a potential bug caused by a improper call to pfree() - Mailing list pgsql-bugs

From wliang@stu.xidian.edu.cn
Subject Report a potential bug caused by a improper call to pfree()
Date
Msg-id 662c1e07.2b1.17ea8e13613.Coremail.wliang@stu.xidian.edu.cn
Whole thread Raw
Responses Re: Report a potential bug caused by a improper call to pfree()  (Julien Rouhaud <rjuju123@gmail.com>)
List pgsql-bugs
Tree view
Hi all,

I find a potential bug caused by a improper call to pfree in PostgresSQL 14.1, which is in  backend/utils/adt/jsonb_gin.c

Specifically,  at line 1116, the pointer 'stack' is assigned with the address of a local variable 'tail'.
At line 1163, pfree() is called to free 'stack'. However, pfree is designed to free the memory in heap rather than stack.


1090 Datum
1091 gin_extract_jsonb_path(PG_FUNCTION_ARGS)
1092 {
1093     Jsonb      *jb = PG_GETARG_JSONB_P(0);
1094     int32      *nentries = (int32 *) PG_GETARG_POINTER(1);
1095     int         total = JB_ROOT_COUNT(jb);
1096     JsonbIterator *it;
1097     JsonbValue  v;
1098     JsonbIteratorToken r;
1099     PathHashStack tail;
1100     PathHashStack *stack;
1101     GinEntries  entries;

...

1113     /* We keep a stack of partial hashes corresponding to parent key levels      */
1114     tail.parent = NULL;
1115     tail.hash = 0;
1116     stack = &tail;
1117 
1118     it = JsonbIteratorInit(&jb->root);
1119 
1120     while ((r = JsonbIteratorNext(&it, &v, false)) != WJB_DONE)
1121     {
1122         PathHashStack *parent;
1123 
1124         switch (r)
1125         {

...

1158             case WJB_END_ARRAY:
1159             case WJB_END_OBJECT:
1160                 /* Pop the stack */
1161                 parent = stack->parent;
1162                 pfree(stack);


--------------------

I think it may be a potential bug and can be fixed without any side-effect as:


 ++        if (stack != &tail)
1162                pfree(stack);


Thanks!

Wentao Liang

pgsql-bugs by date:

Previous
From: Maxim Boguk
Date:
Subject: Re: BUG #17386: btree index corruption after reindex concurrently on write heavy table
Next
From: Noah Misch
Date:
Subject: Re: BUG #17386: btree index corruption after reindex concurrently on write heavy table