[BUG v13] Crash with event trigger in extension
Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
From: Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
To: pgsql-bugs@lists.postgresql.org
Date: 2020-09-02T17:37:15Z
Lists: pgsql-bugs
Attachments
- bug-ext.bash (application/octet-stream)
- v1-0001-Fix-crash-with-alter-table-event-triggers-in-extensi.patch (text/x-patch)
Hi, Philippe Beaudoin reported to me a crash he was able to reproduce with some extension update script. Please, find in attachment a script that triggers it. Just edit the three first vars to point to a temporary installation and instance. Some git bisect shows the bug was introduced by b5810de3f4, where multi-statement query strings are using different short memory contexts. To make it short, any ALTER TABLE command in an extension script is currently calling lappend to add its command to the currentEventTriggerState->commandList list from its own short context instead of using the context of currentEventTriggerState. Because of this, when we call EventTriggerCollectSimpleCommand() for the top level "ALTER EXTENSION" query, the list has long been removed and a new call of lappend on currentEventTriggerState->commandList raise Assert(IsPointerList(list)). Please, find in attachement a bug fix proposal. I did a very quick look at other ->commandList manipulations in event_trigger.c. They all appear to be in the correct context in a first look. Regards,
Commits
-
Fix use-after-free bug with event triggers and ALTER TABLE.
- cc623ed2f4ac 9.6.20 landed
- 93f726c04fb1 12.5 landed
- 7978ad025478 9.5.24 landed
- 66c036b4f143 11.10 landed
- 41c742a43242 10.15 landed
-
Fix use-after-free bug with event triggers in an extension script
- ced138e8cbac 14.0 landed
- 873cb8fca9b1 13.0 landed