Fix for double free from Tatsuo Ishii

bmomjian · bmomjian · commit 237e0a630634 · 1998-10-06T03:55:43.000Z
diff --git a/src/backend/storage/large_object/inv_api.c b/src/backend/storage/large_object/inv_api.c
@@ -8,7 +8,7 @@
  *
  *
  * IDENTIFICATION
- *	  $Header: /cvsroot/pgsql/src/backend/storage/large_object/inv_api.c,v 1.40 1998/09/04 18:21:11 momjian Exp $
+ *	  $Header: /cvsroot/pgsql/src/backend/storage/large_object/inv_api.c,v 1.41 1998/10/06 03:55:43 momjian Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -669,8 +669,7 @@ inv_fetchtup(LargeObjectDesc *obj_desc, Buffer *buffer)
 		} while (tuple == (HeapTuple) NULL);
 
 		/* remember this tid -- we may need it for later reads/writes */
-		ItemPointerCopy(&(res->heap_iptr), &(obj_desc->htid));
-		pfree(res);
+ 		ItemPointerCopy(&tuple->t_ctid, &obj_desc->htid);
 	}
 	else
 	{

Original file line number	Diff line number	Diff line change
`@@ -8,7 +8,7 @@`
`8`	`8`	`*`
`9`	`9`	`*`
`10`	`10`	`* IDENTIFICATION`
`11`		`- * $Header: /cvsroot/pgsql/src/backend/storage/large_object/inv_api.c,v 1.40 1998/09/04 18:21:11 momjian Exp $`
	`11`	`+ * $Header: /cvsroot/pgsql/src/backend/storage/large_object/inv_api.c,v 1.41 1998/10/06 03:55:43 momjian Exp $`
`12`	`12`	`*`
`13`	`13`	`*-------------------------------------------------------------------------`
`14`	`14`	`*/`
`@@ -669,8 +669,7 @@ inv_fetchtup(LargeObjectDesc obj_desc, Buffer buffer)`
`669`	`669`	`} while (tuple == (HeapTuple) NULL);`
`670`	`670`
`671`	`671`	`/* remember this tid -- we may need it for later reads/writes */`
`672`		`- ItemPointerCopy(&(res->heap_iptr), &(obj_desc->htid));`
`673`		`- pfree(res);`
	`672`	`+ ItemPointerCopy(&tuple->t_ctid, &obj_desc->htid);`
`674`	`673`	`}`
`675`	`674`	`else`
`676`	`675`	`{`