pgsql: Fix access-to-already-freed-memory issue in pgoutput.

From: Masahiko Sawada <msawada(at)postgresql(dot)org>
To: pgsql-committers(at)lists(dot)postgresql(dot)org
Subject: pgsql: Fix access-to-already-freed-memory issue in pgoutput.
Date: 2025-10-09 18:00:25
Message-ID: [email protected]
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-committers

Fix access-to-already-freed-memory issue in pgoutput.

While pgoutput caches relation synchronization information in
RelationSyncCache that resides in CacheMemoryContext, each entry's
information (such as row filter expressions and column lists) is
stored in the entry's private memory context (entry_cxt in
RelationSyncEntry), which is a descendant memory context of the
decoding context. If a logical decoding invoked via SQL functions like
pg_logical_slot_get_binary_changes fails with an error, subsequent
logical decoding executions could access already-freed memory of the
entry's cache, resulting in a crash.

With this change, it's ensured that RelationSyncCache is cleaned up
even in error cases by using a memory context reset callback function.

Backpatch to 15, where entry_cxt was introduced for column filtering
and row filtering.

While the backbranches v13 and v14 have a similar issue where
RelationSyncCache persists even after an error when pgoutput is used
via SQL API, we decided not to backport this fix. This decision was
made because v13 is approaching its final minor release, and we won't
have an chance to fix any new issues that might arise. Additionally,
since using pgoutput via SQL API is not a common use case, the risk
outwights the benefit. If we receive bug reports, we can consider
backporting the fixes then.

Author: vignesh C <vignesh21(at)gmail(dot)com>
Co-authored-by: Masahiko Sawada <sawada(dot)mshk(at)gmail(dot)com>
Reviewed-by: Zhijie Hou <houzj(dot)fnst(at)fujitsu(dot)com>
Reviewed-by: Euler Taveira <euler(at)eulerto(dot)com>
Discussion: https://postgr.es/m/CALDaNm0x-aCehgt8Bevs2cm=uhmwS28MvbYq1=s2Ekf0aDPkOA@mail.gmail.com
Backpatch-through: 15

Branch
------
master

Details
-------
https://git.postgresql.org/pg/commitdiff/b46efe90482bc1105a17955fce02cb3708230f0e

Modified Files
--------------
src/backend/replication/pgoutput/pgoutput.c | 29 ++++++++++++++++++++++++-----
1 file changed, 24 insertions(+), 5 deletions(-)

Browse pgsql-committers by date

  From Date Subject
Next Message Masahiko Sawada 2025-10-09 18:00:29 pgsql: Fix access-to-already-freed-memory issue in pgoutput.
Previous Message Tom Lane 2025-10-09 14:34:05 pgsql: Avoid uninitialized-variable warnings from older compilers.