Fix double-free when XMLSERIALIZE(... INDENT) output exceeds 1GB. In xmltotext_with_options(), xmlSaveClose() frees the save context unconditionally, but ctxt was only reset to NULL on the error branch. When the close succeeded and a later step threw an error -- typically, cstring_to_text_with_len() rejecting a result larger than MaxAllocSize -- control reached the PG_CATCH block with ctxt still pointing at the freed context, so xmlSaveClose() was called a second time on freed memory and crashed the backend.
Author: Jim Jones <[email protected]> Reviewed-by: Tom Lane <[email protected]> Discussion: https://postgr.es/m/[email protected] Backpatch-through: 16 Branch ------ REL_18_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/f10500777b2a4d3da6d8d1dd0602e542a4300410 Modified Files -------------- src/backend/utils/adt/xml.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
