Re: Use-after-free in expand_partitioned_rtentry

2025-08-29 Thread Bernd Reiß
Glad I could be of help. I found this through code analysis. I've been working on a custom PG checker, adapting the Clang Static Checker for my bachelor thesis. Always nice to see, when academic work has real world benefits :) Bernd On 8/29/25 3:02 PM, David Rowley wrote: On Fri, 29 Aug 202

Re: Use-after-free in expand_partitioned_rtentry

2025-08-29 Thread David Rowley
On Fri, 29 Aug 2025 at 23:45, Bernd Reiß wrote: > Thanks for the quick response and the review. Thanks for the report, investigation and patch. I've pushed and backpatched this to 15. v14 doesn't have the RelOptInfo.live_parts field, so it didn't suffer from the issue. Technically, 15 isn't brok

Re: Use-after-free in expand_partitioned_rtentry

2025-08-29 Thread Bernd Reiß
Thanks for the quick response and the review. This is admittedly a pretty remote edge case, but still, better safe than sorry. Bernd On 8/29/25 1:29 PM, David Rowley wrote: On Fri, 29 Aug 2025 at 23:16, Bernd Reiß wrote: there seems to be a case of use-after-free in the function expand_par

Re: Use-after-free in expand_partitioned_rtentry

2025-08-29 Thread David Rowley
On Fri, 29 Aug 2025 at 23:16, Bernd Reiß wrote: > there seems to be a case of use-after-free in the function > expand_partitioned_rtentry (src/backend/optimizer/util/inherit.c). In > the NULL-check introduced to handle concurrently detached and dropped > partitions (see [1]), the partition gets re

Use-after-free in expand_partitioned_rtentry

2025-08-29 Thread Bernd Reiß
Hello everyone, there seems to be a case of use-after-free in the function expand_partitioned_rtentry (src/backend/optimizer/util/inherit.c). In the NULL-check introduced to handle concurrently detached and dropped partitions (see [1]), the partition gets removed from the set of live partitio