1berry/postgres
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

plpgsql's exec_assign_value() freed the old value of a variable before

Browse Source 
copying/converting the new value, which meant that it failed badly on
"var := var" if var is of pass-by-reference type.  Fix this and a similar
hazard in exec_move_row(); not sure that the latter can manifest before
8.0, but patch it all the way back anyway.  Per report from Dave Chapeskie.
This commit is contained in:
Tom Lane 2005-06-20 20:45:12 +00:00
parent 2b91c8cf00
commit 224501ed68
1 changed files with 31 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

51
src/pl/plpgsql/src/pl_exec.c
View File

@ -3,7 +3,7 @@
* procedural language * procedural language
* *
* IDENTIFICATION * IDENTIFICATION
* $Header: /cvsroot/pgsql/src/pl/plpgsql/src/pl_exec.c,v 1.52.2.1 2002/03/25 07:41:21 tgl Exp $ * $Header: /cvsroot/pgsql/src/pl/plpgsql/src/pl_exec.c,v 1.52.2.2 2005/06/20 20:45:12 tgl Exp $
* *
* This software is copyrighted by Jan Wieck - Hamburg. * This software is copyrighted by Jan Wieck - Hamburg.
* *
@ -2665,12 +2665,6 @@ exec_assign_value(PLpgSQL_execstate * estate,
*/ */
var = (PLpgSQL_var *) target; var = (PLpgSQL_var *) target;
if (var->freeval)
{
pfree((void *) (var->value));
var->freeval = false;
}
newvalue = exec_cast_value(value, valtype, var->datatype->typoid, newvalue = exec_cast_value(value, valtype, var->datatype->typoid,
&(var->datatype->typinput), &(var->datatype->typinput),
var->datatype->typelem, var->datatype->typelem,
@ -2690,23 +2684,28 @@ exec_assign_value(PLpgSQL_execstate * estate,
if (!var->datatype->typbyval && !*isNull) if (!var->datatype->typbyval && !*isNull)
{ {
if (newvalue == value) if (newvalue == value)
{ newvalue = datumCopy(newvalue,
int len; false,
var->datatype->typlen);
}
if (var->datatype->typlen < 0) /*
len = VARSIZE(newvalue); * Now free the old value. (We can't do this any earlier
else * because of the possibility that we are assigning the
len = var->datatype->typlen; * var's old value to it, eg "foo := foo". We could optimize
var->value = (Datum) palloc(len); * out the assignment altogether in such cases, but it's too
memcpy((void *) (var->value), (void *) newvalue, len); * infrequent to be worth testing for.)
*/
if (var->freeval)
{
pfree(DatumGetPointer(var->value));
var->freeval = false;
} }
else
var->value = newvalue;
var->freeval = true;
}
else
var->value = newvalue; var->value = newvalue;
var->isnull = *isNull; var->isnull = *isNull;
if (!var->datatype->typbyval && !*isNull)
var->freeval = true;
break; break;
case PLPGSQL_DTYPE_RECFIELD: case PLPGSQL_DTYPE_RECFIELD:
@ -3145,6 +3144,14 @@ exec_move_row(PLpgSQL_execstate * estate,
*/ */
if (rec != NULL) if (rec != NULL)
{ {
/*
* copy input first, just in case it is pointing at variable's value
*/
if (HeapTupleIsValid(tup))
tup = heap_copytuple(tup);
if (tupdesc)
tupdesc = CreateTupleDescCopy(tupdesc);
if (rec->freetup) if (rec->freetup)
{ {
heap_freetuple(rec->tup); heap_freetuple(rec->tup);
@ -3158,8 +3165,8 @@ exec_move_row(PLpgSQL_execstate * estate,
if (HeapTupleIsValid(tup)) if (HeapTupleIsValid(tup))
{ {
rec->tup = heap_copytuple(tup); rec->tup = tup;
rec->tupdesc = CreateTupleDescCopy(tupdesc); rec->tupdesc = tupdesc;
rec->freetup = true; rec->freetup = true;
rec->freetupdesc = true; rec->freetupdesc = true;
} }