waldump: fix use-after-free in search_directory().

anarazel · anarazel · commit 5ebd262dcbac · 2022-03-27T18:15:15.000-07:00
After closedir() dirent->d_name is not valid anymore. As there alerady are a few places relying on the limited lifetime of pg_waldump, do so here as well, and just pg_strdup() the string. The bug was introduced in fc49e24. Found by UBSan, run locally. Backpatch: 11-, like fc49e24 itself.
diff --git a/src/bin/pg_waldump/pg_waldump.c b/src/bin/pg_waldump/pg_waldump.c
@@ -180,7 +180,7 @@ search_directory(const char *directory, const char *fname)
 			if (IsXLogFileName(xlde->d_name))
 			{
 				fd = open_file_in_directory(directory, xlde->d_name);
-				fname = xlde->d_name;
+				fname = pg_strdup(xlde->d_name);
 				break;
 			}
 		}

Original file line number	Diff line number	Diff line change
`@@ -180,7 +180,7 @@ search_directory(const char directory, const char fname)`
`180`	`180`	`if (IsXLogFileName(xlde->d_name))`
`181`	`181`	`{`
`182`	`182`	`fd = open_file_in_directory(directory, xlde->d_name);`
`183`		`- fname = xlde->d_name;`
	`183`	`+ fname = pg_strdup(xlde->d_name);`
`184`	`184`	`break;`
`185`	`185`	`}`
`186`	`186`	`}`