Re: Bug in bttext_abbrev_convert()

On Mon, Jun 29, 2015 at 7:47 PM, Peter Geoghegan <pg(at)heroku(dot)com> wrote:
> Commits b181a919 and arguably c79b6413 added bugs to
> bttext_abbrev_convert() in the process of fixing some others. In the
> master branch, bttext_abbrev_convert() can leak memory when the C
> locale happens to be used and we must detoast, which is unacceptable
> for about the same reason that it's unacceptable for a standard B-Tree
> comparator routine. There could also be a use-after-free issue for
> large strings that are detoasted, because bttext_abbrev_convert()
> hashes memory which might already be freed (when hashing the
> authoritative value).
>
> Attached patch fixes these issues.
>
> As we all know, the state of automated testing is pretty lamentable.
> This is the kind of thing that we could catch more easily in the
> future if better infrastructure were in place. I caught this by
> eyeballing bttext_abbrev_convert() with slightly fresher eyes than the
> last time I looked.

Committed.

--
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company