Report a potential bug caused by a improper call to pfree()

Поиск
Список
Период
Сортировка
От wliang@stu.xidian.edu.cn
Тема Report a potential bug caused by a improper call to pfree()
Дата
Msg-id 662c1e07.2b1.17ea8e13613.Coremail.wliang@stu.xidian.edu.cn
обсуждение исходный текст
Ответы Re: Report a potential bug caused by a improper call to pfree()  (Julien Rouhaud <rjuju123@gmail.com>)
Список pgsql-bugs
Дерево обсуждения
Hi all,

I find a potential bug caused by a improper call to pfree in PostgresSQL 14.1, which is in  backend/utils/adt/jsonb_gin.c

Specifically,  at line 1116, the pointer 'stack' is assigned with the address of a local variable 'tail'.
At line 1163, pfree() is called to free 'stack'. However, pfree is designed to free the memory in heap rather than stack.


1090 Datum
1091 gin_extract_jsonb_path(PG_FUNCTION_ARGS)
1092 {
1093     Jsonb      *jb = PG_GETARG_JSONB_P(0);
1094     int32      *nentries = (int32 *) PG_GETARG_POINTER(1);
1095     int         total = JB_ROOT_COUNT(jb);
1096     JsonbIterator *it;
1097     JsonbValue  v;
1098     JsonbIteratorToken r;
1099     PathHashStack tail;
1100     PathHashStack *stack;
1101     GinEntries  entries;

...

1113     /* We keep a stack of partial hashes corresponding to parent key levels      */
1114     tail.parent = NULL;
1115     tail.hash = 0;
1116     stack = &tail;
1117 
1118     it = JsonbIteratorInit(&jb->root);
1119 
1120     while ((r = JsonbIteratorNext(&it, &v, false)) != WJB_DONE)
1121     {
1122         PathHashStack *parent;
1123 
1124         switch (r)
1125         {

...

1158             case WJB_END_ARRAY:
1159             case WJB_END_OBJECT:
1160                 /* Pop the stack */
1161                 parent = stack->parent;
1162                 pfree(stack);


--------------------

I think it may be a potential bug and can be fixed without any side-effect as:


 ++        if (stack != &tail)
1162                pfree(stack);


Thanks!

Wentao Liang

В списке pgsql-bugs по дате отправления:

Предыдущее
От: Maxim Boguk
Дата:
Сообщение: Re: BUG #17386: btree index corruption after reindex concurrently on write heavy table
Следующее
От: Noah Misch
Дата:
Сообщение: Re: BUG #17386: btree index corruption after reindex concurrently on write heavy table