diff options
| author | David Rowley <drowley@postgresql.org> | 2020-04-18 14:10:37 +1200 |
|---|---|---|
| committer | David Rowley <drowley@postgresql.org> | 2020-04-18 14:10:37 +1200 |
| commit | 3cb02e307e350caf3c9099c6f661a95fd00e7e4c (patch) | |
| tree | e8fb5dda3b901f6da179cbe04c49b99dcdac6293 /src/backend/executor/nodeModifyTable.c | |
| parent | 737d69ffc3cfb2e093975411c1becd65ad029478 (diff) | |
| download | postgresql-3cb02e307e350caf3c9099c6f661a95fd00e7e4c.tar.gz postgresql-3cb02e307e350caf3c9099c6f661a95fd00e7e4c.zip | |
Fix possible crash with GENERATED ALWAYS columns
In some corner cases, this could also lead to corrupted values being
included in the tuple.
Users who are concerned that they are affected by this should first
upgrade and then perform a base backup of their database and restore onto
an off-line server. They should then query each table with generated
columns to ensure there are no rows where the generated expression does
not match a newly calculated version of the GENERATED ALWAYS expression.
If no crashes occur and no rows are returned then you're not affected.
Fixes bug #16369.
Reported-by: Cameron Ezell
Discussion: https://postgr.es/m/16369-5845a6f1bef59884@postgresql.org
Backpatch-through: 12 (where GENERATED ALWAYS columns were added.)
Diffstat (limited to 'src/backend/executor/nodeModifyTable.c')
| -rw-r--r-- | src/backend/executor/nodeModifyTable.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/src/backend/executor/nodeModifyTable.c b/src/backend/executor/nodeModifyTable.c index d71c0a43220..20a4c474cc4 100644 --- a/src/backend/executor/nodeModifyTable.c +++ b/src/backend/executor/nodeModifyTable.c @@ -336,6 +336,13 @@ ExecComputeStoredGenerated(EState *estate, TupleTableSlot *slot, CmdType cmdtype val = ExecEvalExpr(resultRelInfo->ri_GeneratedExprs[i], econtext, &isnull); + /* + * We must make a copy of val as we have no guarantees about where + * memory for a pass-by-reference Datum is located. + */ + if (!isnull) + val = datumCopy(val, attr->attbyval, attr->attlen); + values[i] = val; nulls[i] = isnull; } |