pg.ddx.io pgsql-committers@postgresql.org mailing list archive
help / color / mirror / Atom feedpgsql: Fix theoretical bug in tuplesort
9+ messages / 3 participants
[nested] [flat]
Commits from this thread:
2021-07-13 5bd38d2f28 a92709fed6 2fde8e49a2 645c5d1193 eff751ea5f d7f10f39ca d0e44bae49 Robustify tuplesort's free_sort_tuple function
* pgsql: Fix theoretical bug in tuplesort
@ 2021-07-13 00:40 David Rowley <drowley@postgresql.org>
0 siblings, 1 reply; 9+ messages in thread
From: David Rowley @ 2021-07-13 00:40 UTC (permalink / raw)
To: pgsql-committers@lists.postgresql.org
Fix theoretical bug in tuplesort
This fixes a theoretical bug in tuplesort.c which, if a bounded sort was
used in combination with a byval Datum sort (tuplesort_begin_datum), when
switching the sort to a bounded heap in make_bounded_heap(), we'd call
free_sort_tuple(). The problem was that when sorting Datums of a byval
type, the tuple is NULL and free_sort_tuple() would free the memory for it
regardless of that. This would result in a crash.
Here we fix that simply by adding a check to see if the tuple is NULL
before trying to disassociate and free any memory belonging to it.
The reason this bug is only theoretical is that nowhere in the current
code base do we do tuplesort_set_bound() when performing a Datum sort.
However, let's backpatch a fix for this as if any extension uses the code
in this way then it's likely to cause problems.
Author: Ronan Dunklau
Discussion: https://postgr.es/m/CAApHDvpdoqNC5FjDb3KUTSMs5dg6f+XxH4Bg_dVcLi8UYAG3EQ@mail.gmail.com
Backpatch-through: 9.6, oldest supported version
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/41469253e970b539a4ae75226dd4f226b7b2bc8c
Modified Files
--------------
src/backend/utils/sort/tuplesort.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
^ permalink raw reply [nested|flat] 9+ messages in thread
* pgsql: Fix theoretical bug in tuplesort
@ 2021-07-13 00:42 David Rowley <drowley@postgresql.org>
0 siblings, 0 replies; 9+ messages in thread
From: David Rowley @ 2021-07-13 00:42 UTC (permalink / raw)
To: pgsql-committers@lists.postgresql.org
Fix theoretical bug in tuplesort
This fixes a theoretical bug in tuplesort.c which, if a bounded sort was
used in combination with a byval Datum sort (tuplesort_begin_datum), when
switching the sort to a bounded heap in make_bounded_heap(), we'd call
free_sort_tuple(). The problem was that when sorting Datums of a byval
type, the tuple is NULL and free_sort_tuple() would free the memory for it
regardless of that. This would result in a crash.
Here we fix that simply by adding a check to see if the tuple is NULL
before trying to disassociate and free any memory belonging to it.
The reason this bug is only theoretical is that nowhere in the current
code base do we do tuplesort_set_bound() when performing a Datum sort.
However, let's backpatch a fix for this as if any extension uses the code
in this way then it's likely to cause problems.
Author: Ronan Dunklau
Discussion: https://postgr.es/m/CAApHDvpdoqNC5FjDb3KUTSMs5dg6f+XxH4Bg_dVcLi8UYAG3EQ@mail.gmail.com
Backpatch-through: 9.6, oldest supported version
Branch
------
REL_14_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/a3b8d91ccd7964e5bec1066c9e598277294efd33
Modified Files
--------------
src/backend/utils/sort/tuplesort.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
^ permalink raw reply [nested|flat] 9+ messages in thread
* Re: pgsql: Fix theoretical bug in tuplesort
@ 2021-07-13 00:42 Tom Lane <tgl@sss.pgh.pa.us>
parent: David Rowley <drowley@postgresql.org>
0 siblings, 1 reply; 9+ messages in thread
From: Tom Lane @ 2021-07-13 00:42 UTC (permalink / raw)
To: David Rowley <drowley@postgresql.org>; +Cc: pgsql-committers@lists.postgresql.org
... btw, wouldn't it be advisable to set stup->tuple to NULL
after dropping the referenced storage?
regards, tom lane
^ permalink raw reply [nested|flat] 9+ messages in thread
* pgsql: Fix theoretical bug in tuplesort
@ 2021-07-13 00:44 David Rowley <drowley@postgresql.org>
0 siblings, 0 replies; 9+ messages in thread
From: David Rowley @ 2021-07-13 00:44 UTC (permalink / raw)
To: pgsql-committers@lists.postgresql.org
Fix theoretical bug in tuplesort
This fixes a theoretical bug in tuplesort.c which, if a bounded sort was
used in combination with a byval Datum sort (tuplesort_begin_datum), when
switching the sort to a bounded heap in make_bounded_heap(), we'd call
free_sort_tuple(). The problem was that when sorting Datums of a byval
type, the tuple is NULL and free_sort_tuple() would free the memory for it
regardless of that. This would result in a crash.
Here we fix that simply by adding a check to see if the tuple is NULL
before trying to disassociate and free any memory belonging to it.
The reason this bug is only theoretical is that nowhere in the current
code base do we do tuplesort_set_bound() when performing a Datum sort.
However, let's backpatch a fix for this as if any extension uses the code
in this way then it's likely to cause problems.
Author: Ronan Dunklau
Discussion: https://postgr.es/m/CAApHDvpdoqNC5FjDb3KUTSMs5dg6f+XxH4Bg_dVcLi8UYAG3EQ@mail.gmail.com
Backpatch-through: 9.6, oldest supported version
Branch
------
REL_13_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/204f646a22f294a359ec463c128d01e1bc9117c5
Modified Files
--------------
src/backend/utils/sort/tuplesort.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
^ permalink raw reply [nested|flat] 9+ messages in thread
* pgsql: Fix theoretical bug in tuplesort
@ 2021-07-13 00:45 David Rowley <drowley@postgresql.org>
0 siblings, 0 replies; 9+ messages in thread
From: David Rowley @ 2021-07-13 00:45 UTC (permalink / raw)
To: pgsql-committers@lists.postgresql.org
Fix theoretical bug in tuplesort
This fixes a theoretical bug in tuplesort.c which, if a bounded sort was
used in combination with a byval Datum sort (tuplesort_begin_datum), when
switching the sort to a bounded heap in make_bounded_heap(), we'd call
free_sort_tuple(). The problem was that when sorting Datums of a byval
type, the tuple is NULL and free_sort_tuple() would free the memory for it
regardless of that. This would result in a crash.
Here we fix that simply by adding a check to see if the tuple is NULL
before trying to disassociate and free any memory belonging to it.
The reason this bug is only theoretical is that nowhere in the current
code base do we do tuplesort_set_bound() when performing a Datum sort.
However, let's backpatch a fix for this as if any extension uses the code
in this way then it's likely to cause problems.
Author: Ronan Dunklau
Discussion: https://postgr.es/m/CAApHDvpdoqNC5FjDb3KUTSMs5dg6f+XxH4Bg_dVcLi8UYAG3EQ@mail.gmail.com
Backpatch-through: 9.6, oldest supported version
Branch
------
REL_12_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/6f1c7a2d0fe0a3cf4a46053f50d0931248ba6e73
Modified Files
--------------
src/backend/utils/sort/tuplesort.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
^ permalink raw reply [nested|flat] 9+ messages in thread
* pgsql: Fix theoretical bug in tuplesort
@ 2021-07-13 00:45 David Rowley <drowley@postgresql.org>
0 siblings, 0 replies; 9+ messages in thread
From: David Rowley @ 2021-07-13 00:45 UTC (permalink / raw)
To: pgsql-committers@lists.postgresql.org
Fix theoretical bug in tuplesort
This fixes a theoretical bug in tuplesort.c which, if a bounded sort was
used in combination with a byval Datum sort (tuplesort_begin_datum), when
switching the sort to a bounded heap in make_bounded_heap(), we'd call
free_sort_tuple(). The problem was that when sorting Datums of a byval
type, the tuple is NULL and free_sort_tuple() would free the memory for it
regardless of that. This would result in a crash.
Here we fix that simply by adding a check to see if the tuple is NULL
before trying to disassociate and free any memory belonging to it.
The reason this bug is only theoretical is that nowhere in the current
code base do we do tuplesort_set_bound() when performing a Datum sort.
However, let's backpatch a fix for this as if any extension uses the code
in this way then it's likely to cause problems.
Author: Ronan Dunklau
Discussion: https://postgr.es/m/CAApHDvpdoqNC5FjDb3KUTSMs5dg6f+XxH4Bg_dVcLi8UYAG3EQ@mail.gmail.com
Backpatch-through: 9.6, oldest supported version
Branch
------
REL_11_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/187e9c3996aa6d82f95385c81d532610fb021309
Modified Files
--------------
src/backend/utils/sort/tuplesort.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
^ permalink raw reply [nested|flat] 9+ messages in thread
* pgsql: Fix theoretical bug in tuplesort
@ 2021-07-13 00:46 David Rowley <drowley@postgresql.org>
0 siblings, 0 replies; 9+ messages in thread
From: David Rowley @ 2021-07-13 00:46 UTC (permalink / raw)
To: pgsql-committers@lists.postgresql.org
Fix theoretical bug in tuplesort
This fixes a theoretical bug in tuplesort.c which, if a bounded sort was
used in combination with a byval Datum sort (tuplesort_begin_datum), when
switching the sort to a bounded heap in make_bounded_heap(), we'd call
free_sort_tuple(). The problem was that when sorting Datums of a byval
type, the tuple is NULL and free_sort_tuple() would free the memory for it
regardless of that. This would result in a crash.
Here we fix that simply by adding a check to see if the tuple is NULL
before trying to disassociate and free any memory belonging to it.
The reason this bug is only theoretical is that nowhere in the current
code base do we do tuplesort_set_bound() when performing a Datum sort.
However, let's backpatch a fix for this as if any extension uses the code
in this way then it's likely to cause problems.
Author: Ronan Dunklau
Discussion: https://postgr.es/m/CAApHDvpdoqNC5FjDb3KUTSMs5dg6f+XxH4Bg_dVcLi8UYAG3EQ@mail.gmail.com
Backpatch-through: 9.6, oldest supported version
Branch
------
REL_10_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/b55e478a4c2ca506cacf33691db305a50dc43cc2
Modified Files
--------------
src/backend/utils/sort/tuplesort.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
^ permalink raw reply [nested|flat] 9+ messages in thread
* pgsql: Fix theoretical bug in tuplesort
@ 2021-07-13 00:47 David Rowley <drowley@postgresql.org>
0 siblings, 0 replies; 9+ messages in thread
From: David Rowley @ 2021-07-13 00:47 UTC (permalink / raw)
To: pgsql-committers@lists.postgresql.org
Fix theoretical bug in tuplesort
This fixes a theoretical bug in tuplesort.c which, if a bounded sort was
used in combination with a byval Datum sort (tuplesort_begin_datum), when
switching the sort to a bounded heap in make_bounded_heap(), we'd call
free_sort_tuple(). The problem was that when sorting Datums of a byval
type, the tuple is NULL and free_sort_tuple() would free the memory for it
regardless of that. This would result in a crash.
Here we fix that simply by adding a check to see if the tuple is NULL
before trying to disassociate and free any memory belonging to it.
The reason this bug is only theoretical is that nowhere in the current
code base do we do tuplesort_set_bound() when performing a Datum sort.
However, let's backpatch a fix for this as if any extension uses the code
in this way then it's likely to cause problems.
Author: Ronan Dunklau
Discussion: https://postgr.es/m/CAApHDvpdoqNC5FjDb3KUTSMs5dg6f+XxH4Bg_dVcLi8UYAG3EQ@mail.gmail.com
Backpatch-through: 9.6, oldest supported version
Branch
------
REL9_6_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/87b7a652b3a2a291ec46a6a4592fbbd7e0a96529
Modified Files
--------------
src/backend/utils/sort/tuplesort.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
^ permalink raw reply [nested|flat] 9+ messages in thread
* Re: pgsql: Fix theoretical bug in tuplesort
@ 2021-07-13 00:48 David Rowley <dgrowleyml@gmail.com>
parent: Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 0 replies; 9+ messages in thread
From: David Rowley @ 2021-07-13 00:48 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: David Rowley <drowley@postgresql.org>; pgsql-committers@lists.postgresql.org
On Tue, 13 Jul 2021 at 12:42, Tom Lane <tgl@sss.pgh.pa.us> wrote:
>
> ... btw, wouldn't it be advisable to set stup->tuple to NULL
> after dropping the referenced storage?
I think that's probably a good idea.
I'll adjust that now...
David
^ permalink raw reply [nested|flat] 9+ messages in thread
end of thread, other threads:[~2021-07-13 00:48 UTC | newest]
Thread overview: 9+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2021-07-13 00:40 pgsql: Fix theoretical bug in tuplesort David Rowley <drowley@postgresql.org>
2021-07-13 00:42 ` Tom Lane <tgl@sss.pgh.pa.us>
2021-07-13 00:48 ` David Rowley <dgrowleyml@gmail.com>
2021-07-13 00:42 pgsql: Fix theoretical bug in tuplesort David Rowley <drowley@postgresql.org>
2021-07-13 00:44 pgsql: Fix theoretical bug in tuplesort David Rowley <drowley@postgresql.org>
2021-07-13 00:45 pgsql: Fix theoretical bug in tuplesort David Rowley <drowley@postgresql.org>
2021-07-13 00:45 pgsql: Fix theoretical bug in tuplesort David Rowley <drowley@postgresql.org>
2021-07-13 00:46 pgsql: Fix theoretical bug in tuplesort David Rowley <drowley@postgresql.org>
2021-07-13 00:47 pgsql: Fix theoretical bug in tuplesort David Rowley <drowley@postgresql.org>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox