Re: [HACKERS] Fix freeing of dangling IndexScanDesc.xs_hitup in GiST

2017-05-04 Thread Nikita Glukhov
On 04.05.2017 22:16, Tom Lane wrote: Nikita Glukhov writes: In gistrescan() IndexScanDesc.xs_hitup is not reset after MemoryContextReset() of so->queueCxt in which xs_hitup was allocated, then getNextNearest() tries to pfree() dangling xs_hitup, which results in the reuse of this pointer and

Re: [HACKERS] Fix freeing of dangling IndexScanDesc.xs_hitup in GiST

2017-05-04 Thread Tom Lane
Nikita Glukhov writes: > In gistrescan() IndexScanDesc.xs_hitup is not reset after > MemoryContextReset() of > so->queueCxt in which xs_hitup was allocated, then getNextNearest() tries to > pfree() > dangling xs_hitup, which results in the reuse of this pointer and the > subsequent crash. Righ

[HACKERS] Fix freeing of dangling IndexScanDesc.xs_hitup in GiST

2017-05-04 Thread Nikita Glukhov
Hello, hackers! The last query in the following script crashes Postgres: create table t (id serial, amount int); insert into t (amount) select random() * 1000 from generate_series(1, 100); create extension btree_gist; create index t_gist_idx on t using gist(id, amount); select p.id, p.amount, s