[BUG v13] Crash with event trigger in extension

Jehan-Guillaume de Rorthais <jgdr@dalibo.com>

From: Jehan-Guillaume de Rorthais <jgdr@dalibo.com>
To: pgsql-bugs@lists.postgresql.org
Date: 2020-09-02T17:37:15Z
Lists: pgsql-bugs

Attachments

Hi,

Philippe Beaudoin reported to me a crash he was able to reproduce with some
extension update script. Please, find in attachment a script that triggers it.
Just edit the three first vars to point to a temporary installation and
instance.

Some git bisect shows the bug was introduced by b5810de3f4, where
multi-statement query strings are using different short memory contexts.

To make it short, any ALTER TABLE command in an extension script is 
currently calling lappend to add its command to the
currentEventTriggerState->commandList list from its own short context instead
of using the context of currentEventTriggerState.

Because of this, when we call EventTriggerCollectSimpleCommand() for the top
level "ALTER EXTENSION" query, the list has long been removed and a new call of
lappend on currentEventTriggerState->commandList raise
Assert(IsPointerList(list)).

Please, find in attachement a bug fix proposal. I did a very quick look at
other ->commandList manipulations in event_trigger.c. They all appear to
be in the correct context in a first look.

Regards,

Commits

  1. Fix use-after-free bug with event triggers and ALTER TABLE.

  2. Fix use-after-free bug with event triggers in an extension script