pgsql: Fix crash in json{b}_populate_recordset() and json{b}_to_records

From: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
To: pgsql-committers(at)lists(dot)postgresql(dot)org
Subject: pgsql: Fix crash in json{b}_populate_recordset() and json{b}_to_records
Date: 2018-07-13 18:17:06
Message-ID: E1fe2cs-0004zz-QZ@gemulon.postgresql.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-committers

Fix crash in json{b}_populate_recordset() and json{b}_to_recordset().

As of commit 37a795a60, populate_recordset_worker() tried to pass back
(as rsi.setDesc) a tupdesc that it also had cached in its fn_extra.
But the core executor would free the passed-back tupdesc, risking a
crash if the function were called again in the same query. The safest
and least invasive way to fix that is to make an extra tupdesc copy
to pass back.

While at it, I failed to resist the temptation to get rid of unnecessary
get_fn_expr_argtype() calls here and in populate_record_worker().

Per report from Dmitry Dolgov; thanks to Michael Paquier and
Andrew Gierth for investigation and discussion.

Discussion: https://postgr.es/m/CA+q6zcWzN9ztCfR47ZwgTr1KLnuO6BAY6FurxXhovP4hxr+yOQ@mail.gmail.com

Branch
------
master

Details
-------
https://git.postgresql.org/pg/commitdiff/4984784f836a061985b356c52253b5d83a0cbe65

Modified Files
--------------
src/backend/utils/adt/jsonfuncs.c | 58 ++++++++++++++++++++++---------------
src/test/regress/expected/json.out | 10 +++++++
src/test/regress/expected/jsonb.out | 10 +++++++
src/test/regress/sql/json.sql | 2 ++
src/test/regress/sql/jsonb.sql | 2 ++
5 files changed, 59 insertions(+), 23 deletions(-)

Browse pgsql-committers by date

  From Date Subject
Next Message Heikki Linnakangas 2018-07-13 19:22:42 Re: pgsql: Fix parallel index and index-only scans to fall back to serial.
Previous Message Alvaro Herrera 2018-07-13 17:17:18 pgsql: Dump foreign keys on partitioned tables