Fix incorrect accessing of pfree'd memory in Memoize For pass-by-reference types, the code added in 0b053e78b, which aimed to resolve a memory leak, was overly aggressive in resetting the per-tuple memory context which could result in pfree'd memory being accessed resulting in failing to find previously cached results in the hash table.
What was happening was prepare_probe_slot() was switching to the per-tuple memory context and calling ExecEvalExpr(). ExecEvalExpr() may have required a memory allocation. Both MemoizeHash_hash() and MemoizeHash_equal() were aggressively resetting the per-tuple context and after determining the hash value, the context would have gotten reset before MemoizeHash_equal() was called. This could have resulted in MemoizeHash_equal() looking at pfree'd memory. This is less likely to have caused issues on a production build as some other allocation would have had to have reused the pfree'd memory to overwrite it. Otherwise, the original contents would have been intact. However, this clearly caused issues on MEMORY_CONTEXT_CHECKING builds. Author: Tender Wang, Andrei Lepikhov Reported-by: Tender Wang (using SQLancer) Reviewed-by: Andrei Lepikhov, Richard Guo, David Rowley Discussion: https://postgr.es/m/cahewxnnt6n6ujkya0z-jlfzvxcwgferqsfhiwa+nylg-x8i...@mail.gmail.com Backpatch-through: 14, where Memoize was added Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/e629846472255c7a636c453a522755ef05489c90 Modified Files -------------- src/backend/executor/nodeMemoize.c | 15 +++++++++++---- src/test/regress/expected/memoize.out | 31 ++++++++++++++++++++++++++++++- src/test/regress/sql/memoize.sql | 23 ++++++++++++++++++++++- 3 files changed, 63 insertions(+), 6 deletions(-)