From aa0226ea2b75e7523fec4ff8a6d00e46ebdbf08e Mon Sep 17 00:00:00 2001 From: Michael Paquier Date: Thu, 31 Jul 2025 15:31:36 +0900 Subject: [PATCH] Fix use-after-free in reorderbuffer.c with ON CONFLICT changes --- src/backend/replication/logical/reorderbuffer.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/backend/replication/logical/reorderbuffer.c b/src/backend/replication/logical/reorderbuffer.c index 5febd154b6ba..09256f32478f 100644 --- a/src/backend/replication/logical/reorderbuffer.c +++ b/src/backend/replication/logical/reorderbuffer.c @@ -2267,6 +2267,7 @@ ReorderBufferProcessTXN(ReorderBuffer *rb, ReorderBufferTXN *txn, { Relation relation = NULL; Oid reloid; + XLogRecPtr change_lsn = InvalidXLogRecPtr; CHECK_FOR_INTERRUPTS(); @@ -2292,6 +2293,7 @@ ReorderBufferProcessTXN(ReorderBuffer *rb, ReorderBufferTXN *txn, Assert(prev_lsn == InvalidXLogRecPtr || prev_lsn <= change->lsn); prev_lsn = change->lsn; + change_lsn = change->lsn; /* * Set the current xid to detect concurrent aborts. This is @@ -2317,6 +2319,7 @@ ReorderBufferProcessTXN(ReorderBuffer *rb, ReorderBufferTXN *txn, elog(ERROR, "invalid ordering of speculative insertion changes"); Assert(specinsert->data.tp.oldtuple == NULL); change = specinsert; + change_lsn = change->lsn; change->action = REORDER_BUFFER_CHANGE_INSERT; /* intentionally fall through */ @@ -2599,7 +2602,7 @@ ReorderBufferProcessTXN(ReorderBuffer *rb, ReorderBufferTXN *txn, if (++changes_count >= CHANGES_THRESHOLD) { - rb->update_progress_txn(rb, txn, change->lsn); + rb->update_progress_txn(rb, txn, change_lsn); changes_count = 0; } } -- 2.50.0