]> git.ipfire.org Git - thirdparty/postgresql.git/commit
Fix possible use after free in expand_partitioned_rtentry()
authorDavid Rowley <drowley@postgresql.org>
Fri, 29 Aug 2025 12:51:39 +0000 (00:51 +1200)
committerDavid Rowley <drowley@postgresql.org>
Fri, 29 Aug 2025 12:51:39 +0000 (00:51 +1200)
commit4aea5589106bdaa949e45e8ae6a7e49204a460f6
tree9c2e894cb53f841ee8f3ce0ee79a3c84d5830166
parent3eea4dc2c7cfbd9ef56e34ac25b43ab90fe62c51
Fix possible use after free in expand_partitioned_rtentry()

It's possible that if the only live partition is concurrently dropped
and try_table_open() fails, that the bms_del_member() will pfree the
live_parts Bitmapset.  Since the bms_del_member() call does not assign
the result back to the live_parts local variable, the while loop could
segfault as that variable would still reference the pfree'd Bitmapset.

Backpatch to 15. 52f3de874 was backpatched to 14, but there's no
bms_del_member() there due to live_parts not yet existing in RelOptInfo in
that version.  Technically there's no bug in version 15 as
bms_del_member() didn't pfree when the set became empty prior to
00b41463c (from v16).  Applied to v15 anyway to keep the code similar and
to avoid the bad coding pattern.

Author: Bernd Reiß <bd_reiss@gmx.at>
Reviewed-by: David Rowley <dgrowleyml@gmail.com>
Discussion: https://postgr.es/m/6b88f27a-c45c-4826-8e37-d61a04d90182@gmx.at
Backpatch-through: 15
src/backend/optimizer/util/inherit.c