postgres/timescaledb
1
0
Fork 0
mirror of https://github.com/timescale/timescaledb.git synced 2025-05-19 12:13:24 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix use-after-free in finalize

Browse Source 
Fix use-after-free in fa_perquery_state_init
This commit is contained in:
Sven Klemm 2020-10-19 16:19:43 +02:00 committed by Sven Klemm
parent 253ceeb880
commit 6cd688c366
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
tsl/src/partialize_finalize.c
View File

@ -287,6 +287,7 @@ fa_perquery_state_init(FunctionCallInfo fcinfo)
MemoryContext qcontext = fcinfo->flinfo->fn_mcxt; MemoryContext qcontext = fcinfo->flinfo->fn_mcxt;
MemoryContext oldcontext = MemoryContextSwitchTo(qcontext); MemoryContext oldcontext = MemoryContextSwitchTo(qcontext);
AggState *fa_aggstate = (AggState *) fcinfo->context; AggState *fa_aggstate = (AggState *) fcinfo->context;
bool aggfinalextra;
/* look up catalog entry and populate what we need */ /* look up catalog entry and populate what we need */
inner_agg_tuple = SearchSysCache1(AGGFNOID, inner_agg_fn_oid); inner_agg_tuple = SearchSysCache1(AGGFNOID, inner_agg_fn_oid);
@ -304,6 +305,7 @@ fa_perquery_state_init(FunctionCallInfo fcinfo)
tstate->combine_meta.combinefnoid = inner_agg_form->aggcombinefn; tstate->combine_meta.combinefnoid = inner_agg_form->aggcombinefn;
tstate->combine_meta.deserialfnoid = inner_agg_form->aggdeserialfn; tstate->combine_meta.deserialfnoid = inner_agg_form->aggdeserialfn;
tstate->combine_meta.transtype = inner_agg_form->aggtranstype; tstate->combine_meta.transtype = inner_agg_form->aggtranstype;
aggfinalextra = inner_agg_form->aggfinalextra;
ReleaseSysCache(inner_agg_tuple); ReleaseSysCache(inner_agg_tuple);
/* initialize combine specific state, both the deserialize function and combine function */ /* initialize combine specific state, both the deserialize function and combine function */
@ -369,7 +371,7 @@ fa_perquery_state_init(FunctionCallInfo fcinfo)
int num_args = 1; int num_args = 1;
Oid *types = NULL; Oid *types = NULL;
size_t number_types = 0; size_t number_types = 0;
if (inner_agg_form->aggfinalextra) if (aggfinalextra)
{ {
types = get_input_types(input_types, &number_types); types = get_input_types(input_types, &number_types);
num_args += number_types; num_args += number_types;
@ -392,7 +394,7 @@ fa_perquery_state_init(FunctionCallInfo fcinfo)
int i; int i;
build_aggregate_finalfn_expr(types, build_aggregate_finalfn_expr(types,
num_args, num_args,
inner_agg_form->aggtranstype, tstate->combine_meta.transtype,
types[number_types - 1], types[number_types - 1],
collation, collation,
tstate->final_meta.finalfnoid, tstate->final_meta.finalfnoid,