pgpool2.git / summary / log / commit / refs

commit    17bc8a893f8a5393c1e5216177fb11d7ba90d561
Author:   Tatsuo Ishii <ishii@postgresql.org>
Date:     Thu Sep 03 01:28:29 2015 +0000

    Fix ancient bug of pool_push() and friends.
    
    It allocates buffer using realloc and uses the pointer
    returned. However it does the pointer calculation *before* realloc
    gets called. So the calculation uses the old pointer value, which
    causes various problems including segfault later. It is surprising
    that this bug was not found earlier because the bug was there since
    the function was added. This is probably due to the fact that actual
    pointer moving does not happen until certain amount of memory.
    
    Also there were other problems with it. The buffer pointer and buffer
    size variable is not initialized. The buffer is not freed by
    pool_close. Typo in debugging message (3.4 or later only). They are
    fixed as well.


 src/utils/pool_stream.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/src/utils/pool_stream.c b/src/utils/pool_stream.c
index 9197b81b3..f84d355e5 100644
--- a/src/utils/pool_stream.c
+++ b/src/utils/pool_stream.c
@@ -5,7 +5,7 @@
 * pgpool: a language independent connection pool server for PostgreSQL
 * written by Tatsuo Ishii
 *
-* Copyright (c) 2003-2013	PgPool Global Development Group
+* Copyright (c) 2003-2015	PgPool Global Development Group
 *
 * Permission to use, copy, modify, and distribute this software and
 * its documentation for any purpose and without fee is hereby
@@ -91,6 +91,8 @@ POOL_CONNECTION *pool_open(int fd, bool backend_connection)
 	cp->sbufsz = 0;
 	cp->buf2 = NULL;
 	cp->bufsz2 = 0;
+	cp->buf3 = NULL;
+	cp->bufsz3 = 0;
 
 	cp->fd = fd;
 	cp->socket_state = POOL_SOCKET_VALID;
@@ -118,6 +120,8 @@ void pool_close(POOL_CONNECTION *cp)
 		pfree(cp->sbuf);
 	if (cp->buf2)
 		pfree(cp->buf2);
+	if (cp->buf3)
+		pfree(cp->buf3);
 	pool_discard_params(&cp->params);
 
 	pool_ssl_close(cp);
@@ -995,7 +999,7 @@ int pool_push(POOL_CONNECTION *cp, void *data, int len)
 	char *p;
 
 	ereport(DEBUG1,
-		(errmsg("flushing data of len: %d", len)));
+		(errmsg("pushing data of len: %d", len)));
 
 
     MemoryContext oldContext = SwitchToConnectionContext(cp->isbackend);
@@ -1006,8 +1010,8 @@ int pool_push(POOL_CONNECTION *cp, void *data, int len)
 	}
 	else
 	{
-		p = cp->buf3 + cp->bufsz3;
 		cp->buf3 = repalloc(cp->buf3, cp->bufsz3 + len);
+		p = cp->buf3 + cp->bufsz3;
 	}
 
 	memcpy(p, data, len);


[parent: 38982dbc6dcd]