Horton

Fix use-after-free bug with AfterTriggersTableData.storeslot

Alvaro Herrera <alvherre@alvh.no-ip.org>

View on postgr.es
Commit: 262eb990c72097bd804e5c747fe38bf9b3a1ded9
Author: Alvaro Herrera <alvherre@alvh.no-ip.org>
Date: 2021-02-27T21:09:15Z
Releases: 12.7 
Fix use-after-free bug with AfterTriggersTableData.storeslot

AfterTriggerSaveEvent() wrongly allocates the slot in execution-span
memory context, whereas the correct thing is to allocate it in
a transaction-span context, because that's where the enclosing
AfterTriggersTableData instance belongs into.

Backpatch to 12 (the test back to 11, where it works well with no code
changes, and it's good to have to confirm that the case was previously
well supported); this bug seems introduced by commit ff11e7f4b9ae.

Reported-by: Bertrand Drouvot <bdrouvot@amazon.com>
Author: Amit Langote <amitlangote09@gmail.com>
Discussion: https://postgr.es/m/39a71864-b120-5a5c-8cc5-c632b6f16761@amazon.com

Files

PathChange+/−
src/backend/commands/trigger.c modified +33 −19
src/test/regress/expected/triggers.out modified +59 −0
src/test/regress/sql/triggers.sql modified +65 −0

Discussion