Bug in bttext_abbrev_convert()

From: Peter Geoghegan <pg(at)heroku(dot)com>
To: Pg Hackers <pgsql-hackers(at)postgresql(dot)org>
Cc: Robert Haas <robertmhaas(at)gmail(dot)com>
Subject: Bug in bttext_abbrev_convert()
Date: 2015-06-29 23:47:32
Message-ID: CAM3SWZQgLSAYP1wYUaGfFvFd2HXOes7sLsjw0gjOKKCexZsHZw@mail.gmail.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

Commits b181a919 and arguably c79b6413 added bugs to
bttext_abbrev_convert() in the process of fixing some others. In the
master branch, bttext_abbrev_convert() can leak memory when the C
locale happens to be used and we must detoast, which is unacceptable
for about the same reason that it's unacceptable for a standard B-Tree
comparator routine. There could also be a use-after-free issue for
large strings that are detoasted, because bttext_abbrev_convert()
hashes memory which might already be freed (when hashing the
authoritative value).

Attached patch fixes these issues.

As we all know, the state of automated testing is pretty lamentable.
This is the kind of thing that we could catch more easily in the
future if better infrastructure were in place. I caught this by
eyeballing bttext_abbrev_convert() with slightly fresher eyes than the
last time I looked.
--
Peter Geoghegan

Attachment Content-Type Size
0001-Fix-memory-management-bugs-in-text-abbreviation.patch text/x-patch 1.4 KB

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Jeff Janes 2015-06-30 00:37:02 LWLock deadlock and gdb advice
Previous Message Jeff Janes 2015-06-29 23:18:01 Re: PANIC in GIN code