postgres.git / summary / log / commit / refs

commit    b7ffa0ee8d55af0eb236d7496853c38c266d96d5
Author:   Tom Lane <tgl@sss.pgh.pa.us>
Date:     Sun Mar 24 19:13:21 2019 +0000
First released in: 12.0, 9.4.22, 9.5.17, 9.6.13, 10.8, 11.3

    Avoid double-free in vacuumlo error path.
    
    The code would do "PQclear(res)" twice if lo_unlink failed, evidently
    due to careless thinking about how far out a "break" would break.
    Remove the extra PQclear and adjust the loop logic so that we'll fall
    out of both levels of loop after an error, as was clearly the intent.
    
    Spotted by Coverity.  I have no idea why it took this long to notice,
    since the bug has been there since commit 67ccbb080.  Accordingly,
    back-patch to all supported branches.


 contrib/vacuumlo/vacuumlo.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/contrib/vacuumlo/vacuumlo.c b/contrib/vacuumlo/vacuumlo.c
index 7eb474ca3e4..8dbcaad797a 100644
--- a/contrib/vacuumlo/vacuumlo.c
+++ b/contrib/vacuumlo/vacuumlo.c
@@ -316,7 +316,7 @@ vacuumlo(const char *database, const struct _param *param)
 
 	deleted = 0;
 
-	while (1)
+	do
 	{
 		res = PQexec(conn, buf);
 		if (PQresultStatus(res) != PGRES_TUPLES_OK)
@@ -354,8 +354,7 @@ vacuumlo(const char *database, const struct _param *param)
 					if (PQtransactionStatus(conn) == PQTRANS_INERROR)
 					{
 						success = false;
-						PQclear(res);
-						break;
+						break;	/* out of inner for-loop */
 					}
 				}
 				else
@@ -393,7 +392,7 @@ vacuumlo(const char *database, const struct _param *param)
 		}
 
 		PQclear(res);
-	}
+	} while (success);
 
 	/*
 	 * That's all folks!


[parent: 89f39736f484]