Fix incorrect accessing of pfree'd memory in Memoize For pass-by-reference types, the code added in 0b053e78b, which aimed to resolve a memory leak, was overly aggressive in resetting the per-tuple memory context which could result in pfree'd memory being accessed resulting in failing to find previously cached results in the hash table.
What was happening was prepare_probe_slot() was switching to the per-tuple memory context and calling ExecEvalExpr(). ExecEvalExpr() may have required a memory allocation. Both MemoizeHash_hash() and MemoizeHash_equal() were aggressively resetting the per-tuple context and after determining the hash value, the context would have gotten reset before MemoizeHash_equal() was called. This could have resulted in MemoizeHash_equal() looking at pfree'd memory. This is less likely to have caused issues on a production build as some other allocation would have had to have reused the pfree'd memory to overwrite it. Otherwise, the original contents would have been intact. However, this clearly caused issues on MEMORY_CONTEXT_CHECKING builds. Author: Tender Wang, Andrei Lepikhov Reported-by: Tender Wang (using SQLancer) Reviewed-by: Andrei Lepikhov, Richard Guo, David Rowley Discussion: https://postgr.es/m/cahewxnnt6n6ujkya0z-jlfzvxcwgferqsfhiwa+nylg-x8i...@mail.gmail.com Backpatch-through: 14, where Memoize was added Branch ------ REL_15_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/74530804fcb7a36175fa1268928cba98aa9e6cff Modified Files -------------- src/backend/executor/nodeMemoize.c | 15 +++++++++++---- src/test/regress/expected/memoize.out | 31 ++++++++++++++++++++++++++++++- src/test/regress/sql/memoize.sql | 23 ++++++++++++++++++++++- 3 files changed, 63 insertions(+), 6 deletions(-)