public inbox for [email protected]  

help / color / mirror / Atom feed

From: Matthias van de Meent <[email protected]>
To: PostgreSQL Hackers <[email protected]>
Cc: Konstantin Knizhnik <[email protected]>
Subject: Potential memory leak in contrib/intarray's g_intbig_compress
Date: Thu, 13 Jul 2023 14:02:36 +0200
Message-ID: <CAEze2Wi86=DxErfvf+SCB2UKmU2amKOF60BKuJOX=w-RojRn0A@mail.gmail.com> (raw)

Hi,

My collegue Konstantin (cc-ed) noticed that the GiST code of intarray
may leak memory in certain index operations:

> g_intbig_compress(...):
> [...]
>         ArrayType  *in = DatumGetArrayTypeP(entry->key);
> [...]
>         if (in != DatumGetArrayTypeP(entry->key))
>             pfree(in);

DatumGetArrayTypeP will allocate a new, uncompressed copy if the given
Datum is compressed. So in this code, if entry->key is compressed we'd
allocate two decompressed copies, while only we only deallocate the
first of these two. I believe the attached patch fixes the issue.

It looks like this bug has existed since the code was first committed,
so backpatching would go back to 11 if this is an active issue.

Kind regards,

Matthias van de Meent


Attachments:

  [application/octet-stream] 0001-Fix-memory-leak-in-g_intbig_compress.patch (923B, ../CAEze2Wi86=DxErfvf+SCB2UKmU2amKOF60BKuJOX=w-RojRn0A@mail.gmail.com/2-0001-Fix-memory-leak-in-g_intbig_compress.patch)
  download | inline diff:
From 442c2157e4ebe2980801275008a5a22ec25167b5 Mon Sep 17 00:00:00 2001
From: Matthias van de Meent <[email protected]>
Date: Thu, 13 Jul 2023 13:30:08 +0200
Subject: [PATCH] Fix memory leak in g_intbig_compress

If the array was stored in compressed form, we'd decompress it
twice, but only deallocate one of the decompressed copies.

Reported-by: Konstantin Knizhnik
---
 contrib/intarray/_intbig_gist.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/contrib/intarray/_intbig_gist.c b/contrib/intarray/_intbig_gist.c
index bfba5eef1d..062c8264e2 100644
--- a/contrib/intarray/_intbig_gist.c
+++ b/contrib/intarray/_intbig_gist.c
@@ -178,7 +178,7 @@ g_intbig_compress(PG_FUNCTION_ARGS)
 					  entry->rel, entry->page,
 					  entry->offset, false);
 
-		if (in != DatumGetArrayTypeP(entry->key))
+		if (((Datum) in) != entry->key)
 			pfree(in);
 
 		PG_RETURN_POINTER(retval);
-- 
2.40.1

view thread (2+ messages)

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected]
  Subject: Re: Potential memory leak in contrib/intarray's g_intbig_compress
  In-Reply-To: <CAEze2Wi86=DxErfvf+SCB2UKmU2amKOF60BKuJOX=w-RojRn0A@mail.gmail.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox