diff options
| author | Michael Paquier <michael@paquier.xyz> | 2021-10-13 16:38:07 +0900 |
|---|---|---|
| committer | Michael Paquier <michael@paquier.xyz> | 2021-10-13 16:38:07 +0900 |
| commit | 5b0e7fe1d67235a092be1132bc5c97f1d7f29aaf (patch) | |
| tree | 9d62f6ed0f9834af60b943775d99e450ae8dff35 /src/backend/commands/typecmds.c | |
| parent | 780054bf31a0a6ba781f46c454f0116efee8a74c (diff) | |
| download | postgresql-5b0e7fe1d67235a092be1132bc5c97f1d7f29aaf.tar.gz postgresql-5b0e7fe1d67235a092be1132bc5c97f1d7f29aaf.zip | |
Fix use-after-free with multirange types in CREATE TYPE
The code was freeing the name of the multirange type function stored in
the parse tree but it should not do that. Event triggers could for
example look at such a corrupted parsed tree with a ddl_command_end
event.
Author: Alex Kozhemyakin, Sergey Shinderuk
Reviewed-by: Peter Eisentraut, Michael Paquier
Discussion: https://postgr.es/m/d5042d46-b9cd-6efb-219a-71ed0cf45bc8@postgrespro.ru
Backpatch-through: 14
Diffstat (limited to 'src/backend/commands/typecmds.c')
| -rw-r--r-- | src/backend/commands/typecmds.c | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/src/backend/commands/typecmds.c b/src/backend/commands/typecmds.c index b290629a450..9ab40341793 100644 --- a/src/backend/commands/typecmds.c +++ b/src/backend/commands/typecmds.c @@ -1707,7 +1707,6 @@ DefineRange(ParseState *pstate, CreateRangeStmt *stmt) /* Create cast from the range type to its multirange type */ CastCreate(typoid, multirangeOid, castFuncOid, 'e', 'f', DEPENDENCY_INTERNAL); - pfree(multirangeTypeName); pfree(multirangeArrayName); return address; |