diff options
| author | Andres Freund | 2022-03-23 23:38:43 +0000 |
|---|---|---|
| committer | Andres Freund | 2022-03-28 01:13:50 +0000 |
| commit | 264d284929e0d5a419821f94f16f766b5497c87a (patch) | |
| tree | 432315466ad07f9d7ce3e1104590758e69d5f10d | |
| parent | cc7401d5ca498a84d9b47fd2e01cebd8e830e558 (diff) | |
waldump: fix use-after-free in search_directory().
After closedir() dirent->d_name is not valid anymore. As there alerady are a
few places relying on the limited lifetime of pg_waldump, do so here as well,
and just pg_strdup() the string.
The bug was introduced in fc49e24fa69a.
Found by UBSan, run locally.
Backpatch: 11-, like fc49e24fa69 itself.
| -rw-r--r-- | src/bin/pg_waldump/pg_waldump.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/bin/pg_waldump/pg_waldump.c b/src/bin/pg_waldump/pg_waldump.c index 9ffe9e55bd9..4cb40d068a9 100644 --- a/src/bin/pg_waldump/pg_waldump.c +++ b/src/bin/pg_waldump/pg_waldump.c @@ -204,7 +204,7 @@ search_directory(const char *directory, const char *fname) if (IsXLogFileName(xlde->d_name)) { fd = open_file_in_directory(directory, xlde->d_name); - fname = xlde->d_name; + fname = pg_strdup(xlde->d_name); break; } } |