Fix use-after-free issue in slot synchronization.

Author: Shlok Kyal <shlok.kyal.oss@gmail.com>
Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
Reviewed-by: Amit Kapila <amit.kapila16@gmail.com>
Backpatch-through: 18, where it was introduced
Discussion: https://postgr.es/m/CANhcyEXMrcEdzj-RNGJam0nJHM4y+ttdWsgUCFmXciM7BNKc7A@mail.gmail.com

diff --git a/src/backend/replication/logical/slotsync.c b/src/backend/replication/logical/slotsync.c
index 0be941c643c41c8bdf82eb489c0ab4865ce3e21b..e534ccc449ab87ce18a917c1edf3bc0a9c4cc757 100644 (file)
--- a/src/backend/replication/logical/slotsync.c
+++ b/src/backend/replication/logical/slotsync.c
@@ -1477,7 +1477,6 @@ ReplSlotSyncWorkerMain(const void *startup_data, size_t startup_data_len)
         */
        wrconn = walrcv_connect(PrimaryConnInfo, false, false, false,
                                                        app_name.data, &err);
-       pfree(app_name.data);
 
        if (!wrconn)
                ereport(ERROR,
@@ -1485,6 +1484,8 @@ ReplSlotSyncWorkerMain(const void *startup_data, size_t startup_data_len)
                                errmsg("synchronization worker \"%s\" could not connect to the primary server: %s",
                                           app_name.data, err));
 
+       pfree(app_name.data);
+
        /*
         * Register the disconnection callback.
         *

diff --git a/src/backend/replication/slotfuncs.c b/src/backend/replication/slotfuncs.c
index 36cc2ed4e440f2a04dcd2181a5bf1cd00fa5827d..f5b1793c1c54364aa365faba780a918d05efc9c9 100644 (file)
--- a/src/backend/replication/slotfuncs.c
+++ b/src/backend/replication/slotfuncs.c
@@ -921,7 +921,6 @@ pg_sync_replication_slots(PG_FUNCTION_ARGS)
        /* Connect to the primary server. */
        wrconn = walrcv_connect(PrimaryConnInfo, false, false, false,
                                                        app_name.data, &err);
-       pfree(app_name.data);
 
        if (!wrconn)
                ereport(ERROR,
@@ -929,6 +928,8 @@ pg_sync_replication_slots(PG_FUNCTION_ARGS)
                                errmsg("synchronization worker \"%s\" could not connect to the primary server: %s",
                                           app_name.data, err));
 
+       pfree(app_name.data);
+
        SyncReplicationSlots(wrconn);
 
        walrcv_disconnect(wrconn);