Fix dangling pointer reference in stream_cleanup_files.

We can't access the entry after it is removed from dynahash.

Author: Peter Smith
Discussion: https://postgr.es/m/CAHut+Ps-pL++f6CJwPx2+vUqXuew=Xt-9Bi-6kCyxn+Fwi2M7w@mail.gmail.com

diff --git a/src/backend/replication/logical/worker.c b/src/backend/replication/logical/worker.c
index 21d304a64c3b1fc5babfe9316178a6e3aae1d447..354fbe4b4bc82e1b975f04422687281db88e12da 100644 (file)
--- a/src/backend/replication/logical/worker.c
+++ b/src/backend/replication/logical/worker.c
@@ -2740,14 +2740,14 @@ stream_cleanup_files(Oid subid, TransactionId xid)
 {
        char            path[MAXPGPATH];
        StreamXidHash *ent;
+       bool            found = false;
 
-       /* Remove the xid entry from the stream xid hash */
+       /* By this time we must have created the transaction entry */
        ent = (StreamXidHash *) hash_search(xidhash,
                                                                                (void *) &xid,
-                                                                               HASH_REMOVE,
-                                                                               NULL);
-       /* By this time we must have created the transaction entry */
-       Assert(ent != NULL);
+                                                                               HASH_FIND,
+                                                                               &found);
+       Assert(found);
 
        /* Delete the change file and release the stream fileset memory */
        changes_filename(path, subid, xid);
@@ -2763,6 +2763,9 @@ stream_cleanup_files(Oid subid, TransactionId xid)
                pfree(ent->subxact_fileset);
                ent->subxact_fileset = NULL;
        }
+
+       /* Remove the xid entry from the stream xid hash */
+       hash_search(xidhash, (void *) &xid, HASH_REMOVE, NULL);
 }
 
 /*