postgres.git / summary / log / commit / refs

commit    87b7a652b3a2a291ec46a6a4592fbbd7e0a96529
Author:   David Rowley <drowley@postgresql.org>
Date:     Tue Jul 13 00:46:52 2021 +0000

    Fix theoretical bug in tuplesort
    
    This fixes a theoretical bug in tuplesort.c which, if a bounded sort was
    used in combination with a byval Datum sort (tuplesort_begin_datum), when
    switching the sort to a bounded heap in make_bounded_heap(), we'd call
    free_sort_tuple().  The problem was that when sorting Datums of a byval
    type, the tuple is NULL and free_sort_tuple() would free the memory for it
    regardless of that.  This would result in a crash.
    
    Here we fix that simply by adding a check to see if the tuple is NULL
    before trying to disassociate and free any memory belonging to it.
    
    The reason this bug is only theoretical is that nowhere in the current
    code base do we do tuplesort_set_bound() when performing a Datum sort.
    However, let's backpatch a fix for this as if any extension uses the code
    in this way then it's likely to cause problems.
    
    Author: Ronan Dunklau
    Discussion: https://postgr.es/m/CAApHDvpdoqNC5FjDb3KUTSMs5dg6f+XxH4Bg_dVcLi8UYAG3EQ@mail.gmail.com
    Backpatch-through: 9.6, oldest supported version


 src/backend/utils/sort/tuplesort.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/backend/utils/sort/tuplesort.c b/src/backend/utils/sort/tuplesort.c
index 147889177fa..015c197a77f 100644
--- a/src/backend/utils/sort/tuplesort.c
+++ b/src/backend/utils/sort/tuplesort.c
@@ -4827,6 +4827,9 @@ movetup_datum(void *dest, void *src, unsigned int len)
 static void
 free_sort_tuple(Tuplesortstate *state, SortTuple *stup)
 {
-	FREEMEM(state, GetMemoryChunkSpace(stup->tuple));
-	pfree(stup->tuple);
+	if (stup->tuple)
+	{
+		FREEMEM(state, GetMemoryChunkSpace(stup->tuple));
+		pfree(stup->tuple);
+	}
 }


[parent: fa84ff75a341]