Bug in batch tuplesort memory CLUSTER case (9.6 only)

From: Peter Geoghegan <pg(at)heroku(dot)com>
To: Pg Hackers <pgsql-hackers(at)postgresql(dot)org>
Subject: Bug in batch tuplesort memory CLUSTER case (9.6 only)
Date: 2016-06-27 04:14:05
Message-ID: CAM3SWZR8x=e=o3o+tH6Y1Eae3kpdK4dyod8D6MYT=yC4+O7U7Q@mail.gmail.com
Views: Raw Message | Whole Thread | Download mbox
Thread:
Lists: pgsql-hackers

In general, moving tuplesort.c batch memory caller tuples around
happens when batch memory needs to be recycled, or freed outright with
pfree().

I failed to take into account that CLUSTER tuplesorts need an extra
step when moving caller tuples to a new location (i.e. when moving
HeapTuple caller tuples using memmove()), because their particular
variety of caller tuple happens to itself contain a pointer to
palloc()'d memory. Attached patch fixes this use-after-free bug.

--
Peter Geoghegan

Attachment Content-Type Size
0001-Fix-bug-in-batch-tuplesort-memory-with-CLUSTER.patch text/x-patch 8.6 KB

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Amit Kapila 2016-06-27 04:51:45 Re: Rename max_parallel_degree?
Previous Message Noah Misch 2016-06-27 02:45:13 Re: primary_conninfo missing from pg_stat_wal_receiver