Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Skip to content

Commit b7ffa0e

Browse files
committed
Avoid double-free in vacuumlo error path.
The code would do "PQclear(res)" twice if lo_unlink failed, evidently due to careless thinking about how far out a "break" would break. Remove the extra PQclear and adjust the loop logic so that we'll fall out of both levels of loop after an error, as was clearly the intent. Spotted by Coverity. I have no idea why it took this long to notice, since the bug has been there since commit 67ccbb0. Accordingly, back-patch to all supported branches.
1 parent 89f3973 commit b7ffa0e

File tree

1 file changed

+3
-4
lines changed

1 file changed

+3
-4
lines changed

contrib/vacuumlo/vacuumlo.c

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -316,7 +316,7 @@ vacuumlo(const char *database, const struct _param *param)
316316

317317
deleted = 0;
318318

319-
while (1)
319+
do
320320
{
321321
res = PQexec(conn, buf);
322322
if (PQresultStatus(res) != PGRES_TUPLES_OK)
@@ -354,8 +354,7 @@ vacuumlo(const char *database, const struct _param *param)
354354
if (PQtransactionStatus(conn) == PQTRANS_INERROR)
355355
{
356356
success = false;
357-
PQclear(res);
358-
break;
357+
break; /* out of inner for-loop */
359358
}
360359
}
361360
else
@@ -393,7 +392,7 @@ vacuumlo(const char *database, const struct _param *param)
393392
}
394393

395394
PQclear(res);
396-
}
395+
} while (success);
397396

398397
/*
399398
* That's all folks!

0 commit comments

Comments
 (0)