waldump: fix use-after-free in search_directory().

anarazel · anarazel · commit 264d284929e0 · 2022-03-27T18:13:50.000-07:00
After closedir() dirent->d_name is not valid anymore. As there alerady are a few places relying on the limited lifetime of pg_waldump, do so here as well, and just pg_strdup() the string. The bug was introduced in fc49e24. Found by UBSan, run locally. Backpatch: 11-, like fc49e24 itself.
diff --git a/src/bin/pg_waldump/pg_waldump.c b/src/bin/pg_waldump/pg_waldump.c
@@ -204,7 +204,7 @@ search_directory(const char *directory, const char *fname)
 			if (IsXLogFileName(xlde->d_name))
 			{
 				fd = open_file_in_directory(directory, xlde->d_name);
-				fname = xlde->d_name;
+				fname = pg_strdup(xlde->d_name);
 				break;
 			}
 		}

Original file line number	Diff line number	Diff line change
`@@ -204,7 +204,7 @@ search_directory(const char directory, const char fname)`
`204`	`204`	`if (IsXLogFileName(xlde->d_name))`
`205`	`205`	`{`
`206`	`206`	`fd = open_file_in_directory(directory, xlde->d_name);`
`207`		`- fname = xlde->d_name;`
	`207`	`+ fname = pg_strdup(xlde->d_name);`
`208`	`208`	`break;`
`209`	`209`	`}`
`210`	`210`	`}`