Fix dangling pointer reference in stream_cleanup_files.

We can't access the entry after it is removed from dynahash.

Author: Peter Smith
Discussion: https://postgr.es/m/CAHut+Ps-pL++f6CJwPx2+vUqXuew=Xt-9Bi-6kCyxn+Fwi2M7w@mail.gmail.com

diff --git a/src/backend/replication/logical/worker.c b/src/backend/replication/logical/worker.c
index 21d304a64c3b1fc5babfe9316178a6e3aae1d447..354fbe4b4bc82e1b975f04422687281db88e12da 100644 (file)
--- a/src/backend/replication/logical/worker.c
+++ b/src/backend/replication/logical/worker.c
@@ -2740,14 +2740,14 @@ stream_cleanup_files(Oid subid, TransactionId xid)
 {
    char        path[MAXPGPATH];
    StreamXidHash *ent;
+   bool        found = false;
 
-   /* Remove the xid entry from the stream xid hash */
+   /* By this time we must have created the transaction entry */
    ent = (StreamXidHash *) hash_search(xidhash,
                                        (void *) &xid,
-                                       HASH_REMOVE,
-                                       NULL);
-   /* By this time we must have created the transaction entry */
-   Assert(ent != NULL);
+                                       HASH_FIND,
+                                       &found);
+   Assert(found);
 
    /* Delete the change file and release the stream fileset memory */
    changes_filename(path, subid, xid);
@@ -2763,6 +2763,9 @@ stream_cleanup_files(Oid subid, TransactionId xid)
        pfree(ent->subxact_fileset);
        ent->subxact_fileset = NULL;
    }
+
+   /* Remove the xid entry from the stream xid hash */
+   hash_search(xidhash, (void *) &xid, HASH_REMOVE, NULL);
 }
 
 /*