Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Skip to content

Commit 93f726c

Browse files
committed
Fix use-after-free bug with event triggers and ALTER TABLE.
EventTriggerAlterTableEnd neglected to make sure that it built its output list in the right context. In simple cases this was masked because the function is called in PortalContext which will be sufficiently long-lived anyway; but that doesn't make it not a bug. Commit ced138e fixed this in HEAD and v13, but mistakenly chose not to back-patch further. Back-patch the same code change all the way (I didn't bother with the test case though, as it would prove nothing in pre-v13 branches). Per report from Arseny Sher. Original fix by Jehan-Guillaume de Rorthais. Discussion: https://postgr.es/m/877drcyprb.fsf@ars-thinkpad Discussion: https://postgr.es/m/20200902193715.6e0269d4@firost
1 parent 197014b commit 93f726c

File tree

1 file changed

+6
-0
lines changed

1 file changed

+6
-0
lines changed

src/backend/commands/event_trigger.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1807,9 +1807,15 @@ EventTriggerAlterTableEnd(void)
18071807
/* If no subcommands, don't collect */
18081808
if (list_length(currentEventTriggerState->currentCommand->d.alterTable.subcmds) != 0)
18091809
{
1810+
MemoryContext oldcxt;
1811+
1812+
oldcxt = MemoryContextSwitchTo(currentEventTriggerState->cxt);
1813+
18101814
currentEventTriggerState->commandList =
18111815
lappend(currentEventTriggerState->commandList,
18121816
currentEventTriggerState->currentCommand);
1817+
1818+
MemoryContextSwitchTo(oldcxt);
18131819
}
18141820
else
18151821
pfree(currentEventTriggerState->currentCommand);

0 commit comments

Comments
 (0)