| From: | Michael Meskes <meskes(at)postgresql(dot)org> |
|---|---|
| To: | bianpan2016(at)163(dot)com, pgsql-bugs(at)lists(dot)postgresql(dot)org |
| Subject: | Re: BUG #15104: Double free in the main function in ecpg.c |
| Date: | 2018-03-09 16:33:31 |
| Message-ID: | 1520613211.2488.140.camel@postgresql.org |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-bugs |
> Details: In function main(), the memory hold by variable
> output_filename is
> freed at line 329. It then tries to parse the next command option.
> The freed
> memory will be freed again at line 478 if a crafted option bypass the
> memory
> allocation at line 316. I think set output_filename to NULL after the
> free
> operation at line 329 will fix the issue.
> ...
I haven't had time yet to look into this, but to speed things up, would
you have an example where the double free actually happens?
Thanks.
Michael
--
Michael Meskes
Michael at Fam-Meskes dot De, Michael at Meskes dot (De|Com|Net|Org)
Meskes at (Debian|Postgresql) dot Org
Jabber: michael at xmpp dot meskes dot org
VfL Borussia! Força Barça! SF 49ers! Use Debian GNU/Linux, PostgreSQL
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Kouber Saparev | 2018-03-09 18:55:24 | Unrecognized exception condition "deprecated_feature" |
| Previous Message | Tom Lane | 2018-03-09 14:57:48 | Re: BUG #15105: OpenTransientFile() should be paired with CloseTransientFile() rather than close() |