This is an automated email from the ASF dual-hosted git repository.
yjhjstz pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/cloudberry.git
The following commit(s) were added to refs/heads/main by this push:
new 8dc9eda9e54 Fix use-after-free in GetExtStatisticsName
8dc9eda9e54 is described below
commit 8dc9eda9e54a093d593b93c24b89b12b5085e713
Author: Jianghua Yang <[email protected]>
AuthorDate: Fri May 15 08:55:02 2026 +0800
Fix use-after-free in GetExtStatisticsName
ReleaseSysCache(htup) was called before NameStr(staForm->stxname) was
read, returning a pointer into the already-released tuple buffer.
Copy the name with pstrdup() first, then release the cache entry.
---
src/backend/optimizer/util/plancat.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/src/backend/optimizer/util/plancat.c
b/src/backend/optimizer/util/plancat.c
index 13c2ea77699..f1d08a4d128 100644
--- a/src/backend/optimizer/util/plancat.c
+++ b/src/backend/optimizer/util/plancat.c
@@ -1621,8 +1621,10 @@ GetExtStatisticsName(Oid statOid)
elog(ERROR, "cache lookup failed for statistics object %u",
statOid);
staForm = (Form_pg_statistic_ext) GETSTRUCT(htup);
+ /* Copy the name before releasing the cache entry. */
+ char *result = pstrdup(NameStr(staForm->stxname));
ReleaseSysCache(htup);
- return NameStr(staForm->stxname);
+ return result;
}
/*
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
