pgsql: Prevent possible double-free when update trigger returns oldtup - Mailing list pgsql-committers

From Tom Lane
Subject pgsql: Prevent possible double-free when update trigger returns oldtup
Date
Msg-id E1hyPjr-00062s-9x@gemulon.postgresql.org
Whole thread Raw
List pgsql-committers
Prevent possible double-free when update trigger returns old tuple.

This is a variant of the problem fixed in commit 25b692568, which
unfortunately we failed to detect at the time.  If an update trigger
returns the "old" tuple, as it's entitled to do, then a subsequent
iteration of the loop in ExecBRUpdateTriggers would have "oldtuple"
equal to "trigtuple" and would fail to notice that it shouldn't
free that.

In addition to fixing the code, extend the test case added by
25b692568 so that it covers multiple-trigger-iterations cases.

This problem does not manifest in v12/HEAD, as a result of the
relevant code having been largely rewritten for slotification.
However, include the test case into v12/HEAD anyway, since this
is clearly an area that someone could break again in future.

Per report from Piotr Gabriel Kosinski.  Back-patch into all
supported branches, since the bug seems quite old.

Diagnosis and code fix by Thomas Munro, test case by me.

Discussion: https://postgr.es/m/CAFMLSdP0rd7LqC3j-H6Fh51FYSt5A10DDh-3=W4PPc4LLUQ8YQ@mail.gmail.com

Branch
------
REL_11_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/aed967d697de19a78a653926c72604f9b04c3b1e

Modified Files
--------------
src/backend/commands/trigger.c         |  4 +-
src/test/regress/expected/triggers.out | 70 ++++++++++++++++++++++++++++++++++
src/test/regress/sql/triggers.sql      | 35 +++++++++++++++++
3 files changed, 108 insertions(+), 1 deletion(-)


pgsql-committers by date:

Previous
From: Tom Lane
Date:
Subject: pgsql: Fix plpgsql to re-look-up composite type names at need.
Next
From: Etsuro Fujita
Date:
Subject: pgsql: Remove useless bms_free() calls in build_child_join_rel().