diff options
author | David Rowley <drowley@postgresql.org> | 2025-08-30 00:50:50 +1200 |
---|---|---|
committer | David Rowley <drowley@postgresql.org> | 2025-08-30 00:50:50 +1200 |
commit | da9f9f75e5ce27a45878ffa262156d18f0046188 (patch) | |
tree | a131f5a71515b2c256bb39364e12686905908901 /src/backend/executor/nodeModifyTable.c | |
parent | f225473cbae2cca5e1fde376aa4217a6b3a3f770 (diff) |
Fix possible use after free in expand_partitioned_rtentry()
It's possible that if the only live partition is concurrently dropped
and try_table_open() fails, that the bms_del_member() will pfree the
live_parts Bitmapset. Since the bms_del_member() call does not assign
the result back to the live_parts local variable, the while loop could
segfault as that variable would still reference the pfree'd Bitmapset.
Backpatch to 15. 52f3de874 was backpatched to 14, but there's no
bms_del_member() there due to live_parts not yet existing in RelOptInfo in
that version. Technically there's no bug in version 15 as
bms_del_member() didn't pfree when the set became empty prior to
00b41463c (from v16). Applied to v15 anyway to keep the code similar and
to avoid the bad coding pattern.
Author: Bernd Reiß <bd_reiss@gmx.at>
Reviewed-by: David Rowley <dgrowleyml@gmail.com>
Discussion: https://postgr.es/m/6b88f27a-c45c-4826-8e37-d61a04d90182@gmx.at
Backpatch-through: 15
Diffstat (limited to 'src/backend/executor/nodeModifyTable.c')
0 files changed, 0 insertions, 0 deletions