summaryrefslogtreecommitdiff
path: root/src/backend/executor/nodeModifyTable.c
diff options
context:
space:
mode:
authorDavid Rowley <drowley@postgresql.org>2025-08-30 00:53:17 +1200
committerDavid Rowley <drowley@postgresql.org>2025-08-30 00:53:17 +1200
commit8286bce0a06a3975bc7d292b5c5f972fc31a9a57 (patch)
treeefff68f15885cd43486392c235a25f8b79cc0230 /src/backend/executor/nodeModifyTable.c
parentf9a7622483c30a45e04a700b6dc90b95ff366fba (diff)
Fix possible use after free in expand_partitioned_rtentry()
It's possible that if the only live partition is concurrently dropped and try_table_open() fails, that the bms_del_member() will pfree the live_parts Bitmapset. Since the bms_del_member() call does not assign the result back to the live_parts local variable, the while loop could segfault as that variable would still reference the pfree'd Bitmapset. Backpatch to 15. 52f3de874 was backpatched to 14, but there's no bms_del_member() there due to live_parts not yet existing in RelOptInfo in that version. Technically there's no bug in version 15 as bms_del_member() didn't pfree when the set became empty prior to 00b41463c (from v16). Applied to v15 anyway to keep the code similar and to avoid the bad coding pattern. Author: Bernd Reiß <bd_reiss@gmx.at> Reviewed-by: David Rowley <dgrowleyml@gmail.com> Discussion: https://postgr.es/m/6b88f27a-c45c-4826-8e37-d61a04d90182@gmx.at Backpatch-through: 15
Diffstat (limited to 'src/backend/executor/nodeModifyTable.c')
0 files changed, 0 insertions, 0 deletions