pgsql: Fix use-after-free around DISTINCT transition function calls.

Lists: pgsql-committers
From: Heikki Linnakangas <heikki(dot)linnakangas(at)iki(dot)fi>
To: pgsql-committers(at)postgresql(dot)org
Subject: pgsql: Fix use-after-free around DISTINCT transition function calls.
Date: 2016-10-17 09:18:11
Message-ID: E1bw43f-0004MF-AD@gemulon.postgresql.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Lists: pgsql-committers

Fix use-after-free around DISTINCT transition function calls.

Have tuplesort_gettupleslot() copy the contents of its current table slot
as needed. This is based on an approach taken by tuplestore_gettupleslot().
In the future, tuplesort_gettupleslot() may also be taught to avoid copying
the tuple where caller can determine that that is safe (the
tuplestore_gettupleslot() interface already offers this option to callers).

Patch by Peter Geoghegan. Fixes bug #14344, reported by Regina Obe.

Report: <20160929035538(dot)20224(dot)39628(at)wrigleys(dot)postgresql(dot)org>

Backpatch-through: 9.6

Branch
------
REL9_6_STABLE

Details
-------
http://git.postgresql.org/pg/commitdiff/a5f0bd77a2fab60a52dc335a63efc21abc806aa7

Modified Files
--------------
src/backend/utils/sort/tuplesort.c | 9 +++++++++
1 file changed, 9 insertions(+)