diff options
| author | Michael Paquier <michael@paquier.xyz> | 2025-04-07 09:51:40 +0900 |
|---|---|---|
| committer | Michael Paquier <michael@paquier.xyz> | 2025-04-07 09:51:40 +0900 |
| commit | 3191a593d6dea56def460d06adc779f2aca44976 (patch) | |
| tree | be8c7ea02583a3acd214fd8ecf0c573025d848c2 /src/backend/utils/adt/quote.c | |
| parent | 173c97812ffcc48082355df71470974c33379d3f (diff) | |
| download | postgresql-3191a593d6dea56def460d06adc779f2aca44976.tar.gz postgresql-3191a593d6dea56def460d06adc779f2aca44976.zip | |
Fix use-after-free in pgstat_fetch_stat_backend_by_pid()
stats_fetch_consistency set to "snapshot" causes the backend entry
"beentry" retrieved by pgstat_get_beentry_by_proc_number() to be reset
at the beginning of pgstat_fetch_stat_backend() when fetching the
backend pgstats entry. As coded, "beentry" was being accessed after
being freed. This commit moves all the accesses to "beentry" to happen
before calling pgstat_fetch_stat_backend(), fixing the problem.
This problem could be reached by calling the SQL functions
pg_stat_get_backend_io() or pg_stat_get_backend_wal().
Issue caught by valgrind.
Reported-by: Alexander Lakhin <exclusion@gmail.com>
Author: Bertrand Drouvot <bertranddrouvot.pg@gmail.com>
Discussion: https://postgr.es/m/f1788cc0-253a-4a3a-aee0-1b8ab9538736@gmail.com
Diffstat (limited to 'src/backend/utils/adt/quote.c')
0 files changed, 0 insertions, 0 deletions