postgres.git / summary / log / commit / refs

commit    07554c99dfdbba7809b73e8028cf8a9f5cbfa36f
Author:   David Rowley <drowley@postgresql.org>
Date:     Thu Mar 30 23:15:39 2023 +0000
First released in: 16.0, 11.20, 12.15, 13.11, 14.8, 15.3

    Fix List memory issue in transformColumnDefinition
    
    When calling generateSerialExtraStmts(), we would pass in the
    constraint->options.  In some cases, generateSerialExtraStmts() would
    modify the referenced List to remove elements from it, but doing so is
    invalid without assigning the list back to all variables that point to it.
    In the particular reported problem case, the List became empty, in which
    cases it became NIL, but the passed in constraint->options didn't get to
    find out about that and was left pointing to free'd memory.
    
    To fix this, just perform a list_copy() inside generateSerialExtraStmts().
    We could just do a list_copy() just before we perform the delete from the
    list, however, that seems less robust.  Let's make sure the generated
    CreateSeqStmt gets a completely different copy of the list to be safe.
    
    Bug: #17879
    Reported-by: Fei Changhong
    Diagnosed-by: Fei Changhong
    Discussion: https://postgr.es/m/17879-b7dfb5debee58ff5@postgresql.org
    Backpatch-through: 11, all supported versions


 src/backend/parser/parse_utilcmd.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/backend/parser/parse_utilcmd.c b/src/backend/parser/parse_utilcmd.c
index a9ec1617541..b128af6be03 100644
--- a/src/backend/parser/parse_utilcmd.c
+++ b/src/backend/parser/parse_utilcmd.c
@@ -408,6 +408,9 @@ generateSerialExtraStmts(CreateStmtContext *cxt, ColumnDef *column,
 	AlterSeqStmt *altseqstmt;
 	List	   *attnamelist;
 
+	/* Make a copy of this as we may end up modifying it in the code below */
+	seqoptions = list_copy(seqoptions);
+
 	/*
 	 * Determine namespace and name to use for the sequence.
 	 *


[parent: b5c6776c1127]