postgres.git / summary / log / commit / refs

commit    a9fdb48b737d8335ea8cbb5b5b76c8187397824e
Author:   Tom Lane <tgl@sss.pgh.pa.us>
Date:     Tue Nov 01 16:48:01 2022 +0000
First released in: 16.0, 10.23, 11.18, 12.13, 13.9, 14.6, 15.1

    pg_stat_statements: fetch stmt location/length before it disappears.
    
    When executing a utility statement, we must fetch everything
    we need out of the PlannedStmt data structure before calling
    standard_ProcessUtility.  In certain cases (possibly only ROLLBACK
    in extended query protocol), that data structure will get freed
    during command execution.  The situation is probably often harmless
    in production builds, but in debug builds we intentionally overwrite
    the freed memory with garbage, leading to picking up garbage values
    of statement location and length, typically causing an assertion
    failure later in pg_stat_statements.  In non-debug builds, if
    something did go wrong it would likely lead to storing garbage
    for the query string.
    
    Report and fix by zhaoqigui (with cosmetic adjustments by me).
    It's an old problem, so back-patch to all supported versions.
    
    Discussion: https://postgr.es/m/17663-a344fd0675f92128@postgresql.org
    Discussion: https://postgr.es/m/1667307420050.56657@hundsun.com


 contrib/pg_stat_statements/pg_stat_statements.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/contrib/pg_stat_statements/pg_stat_statements.c b/contrib/pg_stat_statements/pg_stat_statements.c
index b62459725b9..610101b3a30 100644
--- a/contrib/pg_stat_statements/pg_stat_statements.c
+++ b/contrib/pg_stat_statements/pg_stat_statements.c
@@ -1117,6 +1117,8 @@ pgss_ProcessUtility(PlannedStmt *pstmt, const char *queryString,
 					DestReceiver *dest, QueryCompletion *qc)
 {
 	Node	   *parsetree = pstmt->utilityStmt;
+	int			saved_stmt_location = pstmt->stmt_location;
+	int			saved_stmt_len = pstmt->stmt_len;
 
 	/*
 	 * If it's an EXECUTE statement, we don't track it and don't increment the
@@ -1167,6 +1169,13 @@ pgss_ProcessUtility(PlannedStmt *pstmt, const char *queryString,
 		}
 		PG_END_TRY();
 
+		/*
+		 * CAUTION: do not access the *pstmt data structure again below here.
+		 * If it was a ROLLBACK or similar, that data structure may have been
+		 * freed.  We must copy everything we still need into local variables,
+		 * which we did above.
+		 */
+
 		INSTR_TIME_SET_CURRENT(duration);
 		INSTR_TIME_SUBTRACT(duration, start);
 
@@ -1182,8 +1191,8 @@ pgss_ProcessUtility(PlannedStmt *pstmt, const char *queryString,
 
 		pgss_store(queryString,
 				   0,			/* signal that it's a utility stmt */
-				   pstmt->stmt_location,
-				   pstmt->stmt_len,
+				   saved_stmt_location,
+				   saved_stmt_len,
 				   PGSS_EXEC,
 				   INSTR_TIME_GET_MILLISEC(duration),
 				   rows,


[parent: 594b97509e49]