pgsql: Fix dangling-pointer problem in before-row update trigger proces

From: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
To: pgsql-committers(at)postgresql(dot)org
Subject: pgsql: Fix dangling-pointer problem in before-row update trigger proces
Date: 2011-02-22 02:20:22
Message-ID: E1PrhrS-0007uQ-Je@gemulon.postgresql.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-committers

Fix dangling-pointer problem in before-row update trigger processing.

ExecUpdate checked for whether ExecBRUpdateTriggers had returned a new
tuple value by seeing if the returned tuple was pointer-equal to the old
one. But the "old one" was in estate->es_junkFilter's result slot, which
would be scribbled on if we had done an EvalPlanQual update in response to
a concurrent update of the target tuple; therefore we were comparing a
dangling pointer to a live one. Given the right set of circumstances we
could get a false match, resulting in not forcing the tuple to be stored in
the slot we thought it was stored in. In the case reported by Maxim Boguk
in bug #5798, this led to "cannot extract system attribute from virtual
tuple" failures when trying to do "RETURNING ctid". I believe there is a
very-low-probability chance of more serious errors, such as generating
incorrect index entries based on the original rather than the
trigger-modified version of the row.

In HEAD, change all of ExecBRInsertTriggers, ExecIRInsertTriggers,
ExecBRUpdateTriggers, and ExecIRUpdateTriggers so that they continue to
have similar APIs. In the back branches I just changed
ExecBRUpdateTriggers, since there is no bug in the ExecBRInsertTriggers
case.

Branch
------
REL8_3_STABLE

Details
-------
http://git.postgresql.org/pg/commitdiff/e476eedd0c06e81ee6d76fd8dc23eb5d54f1ba0b

Modified Files
--------------
src/backend/commands/trigger.c | 50 ++++++++++++++++++++++++++++++++-------
src/backend/executor/execMain.c | 26 ++++----------------
src/include/commands/trigger.h | 4 +-
3 files changed, 48 insertions(+), 32 deletions(-)

Browse pgsql-committers by date

  From Date Subject
Next Message Tom Lane 2011-02-22 02:41:54 pgsql: Remove ExecRemoveJunk(), which is no longer used anywhere.
Previous Message User Fxjr 2011-02-22 01:30:04 npgsql - Npgsql2: NpgsqlConnector.CancelRequest leaks Connector.