0001-Fix-use-after-free-in-reorderbuffer.c-with-ON-CONFLI.patch
text/x-diff
Filename: 0001-Fix-use-after-free-in-reorderbuffer.c-with-ON-CONFLI.patch
Type: text/x-diff
Part: 0
Patch
Same data as JSON:
GET /api/v1/attachments/:id/patch
the parsed metadata as JSON — format, series position, per-file stats; never the diff bytes.
API reference →
Format: format-patch
Series: patch 0001
Subject: Fix use-after-free in reorderbuffer.c with ON CONFLICT changes
| File | + | − |
|---|---|---|
| src/backend/replication/logical/reorderbuffer.c | 4 | 1 |
From aa0226ea2b75e7523fec4ff8a6d00e46ebdbf08e Mon Sep 17 00:00:00 2001
From: Michael Paquier <michael@paquier.xyz>
Date: Thu, 31 Jul 2025 15:31:36 +0900
Subject: [PATCH] Fix use-after-free in reorderbuffer.c with ON CONFLICT
changes
---
src/backend/replication/logical/reorderbuffer.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/src/backend/replication/logical/reorderbuffer.c b/src/backend/replication/logical/reorderbuffer.c
index 5febd154b6ba..09256f32478f 100644
--- a/src/backend/replication/logical/reorderbuffer.c
+++ b/src/backend/replication/logical/reorderbuffer.c
@@ -2267,6 +2267,7 @@ ReorderBufferProcessTXN(ReorderBuffer *rb, ReorderBufferTXN *txn,
{
Relation relation = NULL;
Oid reloid;
+ XLogRecPtr change_lsn = InvalidXLogRecPtr;
CHECK_FOR_INTERRUPTS();
@@ -2292,6 +2293,7 @@ ReorderBufferProcessTXN(ReorderBuffer *rb, ReorderBufferTXN *txn,
Assert(prev_lsn == InvalidXLogRecPtr || prev_lsn <= change->lsn);
prev_lsn = change->lsn;
+ change_lsn = change->lsn;
/*
* Set the current xid to detect concurrent aborts. This is
@@ -2317,6 +2319,7 @@ ReorderBufferProcessTXN(ReorderBuffer *rb, ReorderBufferTXN *txn,
elog(ERROR, "invalid ordering of speculative insertion changes");
Assert(specinsert->data.tp.oldtuple == NULL);
change = specinsert;
+ change_lsn = change->lsn;
change->action = REORDER_BUFFER_CHANGE_INSERT;
/* intentionally fall through */
@@ -2599,7 +2602,7 @@ ReorderBufferProcessTXN(ReorderBuffer *rb, ReorderBufferTXN *txn,
if (++changes_count >= CHANGES_THRESHOLD)
{
- rb->update_progress_txn(rb, txn, change->lsn);
+ rb->update_progress_txn(rb, txn, change_lsn);
changes_count = 0;
}
}
--
2.50.0