Prevent corner-case core dump in rfree().

rfree() failed to cope with the case that pg_regcomp() had initialized the
regex_t struct but then failed to allocate any memory for re->re_guts (ie,
the first malloc call in pg_regcomp() failed).  It would try to touch the
guts struct anyway, and thus dump core.  This is a sufficiently narrow
corner case that it's not surprising it's never been seen in the field;
but still a bug is a bug, so patch all active branches.

Noted while investigating whether we need to call pg_regfree after a
failure return from pg_regcomp.  Other than this bug, it turns out we
don't, so adjust comments appropriately.

diff --git a/src/backend/regex/regcomp.c b/src/backend/regex/regcomp.c
index ceb6f0f8737e9e34fca9d118669fcc69e796c5f2..5c5a9a8cd2d91f9e57fff47fc21433a26145a949 100644 (file)
--- a/src/backend/regex/regcomp.c
+++ b/src/backend/regex/regcomp.c
@@ -278,6 +278,9 @@ static struct fns functions = {
 
 /*
  * pg_regcomp - compile regular expression
+ *
+ * Note: on failure, no resources remain allocated, so pg_regfree()
+ * need not be applied to re.
  */
 int
 pg_regcomp(regex_t *re,
@@ -1870,15 +1873,18 @@ rfree(regex_t *re)
    g = (struct guts *) re->re_guts;
    re->re_guts = NULL;
    re->re_fns = NULL;
-   g->magic = 0;
-   freecm(&g->cmap);
-   if (g->tree != NULL)
-       freesubre((struct vars *) NULL, g->tree);
-   if (g->lacons != NULL)
-       freelacons(g->lacons, g->nlacons);
-   if (!NULLCNFA(g->search))
-       freecnfa(&g->search);
-   FREE(g);
+   if (g != NULL)
+   {
+       g->magic = 0;
+       freecm(&g->cmap);
+       if (g->tree != NULL)
+           freesubre((struct vars *) NULL, g->tree);
+       if (g->lacons != NULL)
+           freelacons(g->lacons, g->nlacons);
+       if (!NULLCNFA(g->search))
+           freecnfa(&g->search);
+       FREE(g);
+   }
 }
 
 #ifdef REG_DEBUG

diff --git a/src/backend/utils/adt/regexp.c b/src/backend/utils/adt/regexp.c
index 074142e7985499f152e07ab0c4e1c1d0675c4042..92dfbb11ce61f6ea15c3c186c7ff443d0da00335 100644 (file)
--- a/src/backend/utils/adt/regexp.c
+++ b/src/backend/utils/adt/regexp.c
@@ -187,9 +187,8 @@ RE_compile_and_cache(text *text_re, int cflags, Oid collation)
 
    if (regcomp_result != REG_OKAY)
    {
-       /* re didn't compile */
+       /* re didn't compile (no need for pg_regfree, if so) */
        pg_regerror(regcomp_result, &re_temp.cre_re, errMsg, sizeof(errMsg));
-       /* XXX should we pg_regfree here? */
        ereport(ERROR,
                (errcode(ERRCODE_INVALID_REGULAR_EXPRESSION),
                 errmsg("invalid regular expression: %s", errMsg)));