Re: Segmentation fault during update inside ExecBRUpdateTriggers
Tom Lane <tgl@sss.pgh.pa.us>
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Thomas Munro <thomas.munro@gmail.com>
Cc: Piotr Gabriel Kosinski <pg.kosinski@gmail.com>,
PostgreSQL mailing lists <pgsql-bugs@lists.postgresql.org>
Date: 2019-08-15T22:39:24Z
Lists: pgsql-bugs
Thomas Munro <thomas.munro@gmail.com> writes: > Right, this happens on REL_11_STABLE but not on master (which rewrote > the relevant code quite a bit in the "slotification" project). We should probably trace back why it doesn't happen before v11. I have a vague memory of having touched this code a year or two back, so likely this is my fault, but I wonder why it doesn't fail before. > In a very quick test, the following change fixes the problem and > passes regression tests, but I'm not sure if it's the right fix. > - if (oldtuple != newtuple && oldtuple != slottuple) > + if (oldtuple != newtuple && oldtuple != slottuple && > oldtuple != trigtuple) My thoughts were headed in the same direction. It looks like the issue is that the first trigger returns OLD, ie "trigtuple", which gets assigned to "newtuple", and then the second iteration of the loop fails to deal with the aliasing. [ thinks some more... ] Actually, I'm beginning to recall that we made changes here because v11 plpgsql is capable of actually returning "trigtuple" where before it would always have made a copy. If that's accurate, then very likely the bug exists further back but requires some other PL than plpgsql to manifest. I'd be inclined to put a test case exercising this into all branches, even ones not currently showing the bug, because it's clearly a fragile area. regards, tom lane
Commits
-
Prevent possible double-free when update trigger returns old tuple.
- cb0c79ae6231 9.5.20 landed
- afa71d9152a2 9.4.25 landed
- aed967d697de 11.6 landed
- 60886965a271 10.11 landed
- 1fe8d209ed84 9.6.16 landed
- 1ced082b95b3 13.0 landed
- 03813a50efa5 12.0 landed
-
Prevent dangling-pointer access when update trigger returns old tuple.
- 25b692568f42 11.0 cited