Fix potential use-after-free for BEFORE UPDATE row triggers on non-core AMs.

Andres Freund <andres@anarazel.de>

Commit: 75e03eabeaac8fd229b14f74de55d0e1470903c4
Author: Andres Freund <andres@anarazel.de>
Date: 2019-04-19T00:53:54Z
Releases: 12.0
Fix potential use-after-free for BEFORE UPDATE row triggers on non-core AMs.

When such a trigger returns the old row version, it naturally get
stored in the slot for the trigger result. When a table AMs doesn't
store HeapTuples internally, ExecBRUpdateTriggers() frees the old row
version passed to triggers - but before this fix it might still be
referenced by the slot holding the new tuple.

Noticed when running the out-of-core zheap AM against the in-core
version of tableam.

Author: Andres Freund

Files

PathChange+/−
src/backend/commands/trigger.c modified +9 −0