foreach() and list_delete() don't mix.

tglsfdc · tglsfdc · commit 88dc6fa7a164 · 2011-04-17T13:37:39.000-04:00
Fix crash when releasing duplicate entries in the encoding conversion cache
list, caused by releasing the current entry of the list being chased by
foreach().  We have a standard idiom for handling such cases, but this
loop wasn't using it.

This got broken in my recent rewrite of GUC assign hooks.  Not sure how
I missed this when testing the modified code, but I did.  Per report from
Peter.
diff --git a/src/backend/utils/mb/mbutils.c b/src/backend/utils/mb/mbutils.c
@@ -189,6 +189,8 @@ SetClientEncoding(int encoding)
 	int			current_server_encoding;
 	bool		found;
 	ListCell   *lc;
+	ListCell   *prev;
+	ListCell   *next;
 
 	if (!PG_VALID_FE_ENCODING(encoding))
 		return -1;
@@ -222,10 +224,13 @@ SetClientEncoding(int encoding)
 	 * leak memory.
 	 */
 	found = false;
-	foreach(lc, ConvProcList)
+	prev = NULL;
+	for (lc = list_head(ConvProcList); lc; lc = next)
 	{
 		ConvProcInfo *convinfo = (ConvProcInfo *) lfirst(lc);
 
+		next = lnext(lc);
+
 		if (convinfo->s_encoding == current_server_encoding &&
 			convinfo->c_encoding == encoding)
 		{
@@ -240,10 +245,13 @@ SetClientEncoding(int encoding)
 			else
 			{
 				/* Duplicate entry, release it */
-				ConvProcList = list_delete_ptr(ConvProcList, convinfo);
+				ConvProcList = list_delete_cell(ConvProcList, lc, prev);
 				pfree(convinfo);
+				continue;		/* prev mustn't advance */
 			}
 		}
+
+		prev = lc;
 	}
 
 	if (found)

Original file line number	Diff line number	Diff line change
`@@ -189,6 +189,8 @@ SetClientEncoding(int encoding)`
`189`	`189`	`int current_server_encoding;`
`190`	`190`	`bool found;`
`191`	`191`	`ListCell *lc;`
	`192`	`+ ListCell *prev;`
	`193`	`+ ListCell *next;`
`192`	`194`
`193`	`195`	`if (!PG_VALID_FE_ENCODING(encoding))`
`194`	`196`	`return -1;`
`@@ -222,10 +224,13 @@ SetClientEncoding(int encoding)`
`222`	`224`	`* leak memory.`
`223`	`225`	`*/`
`224`	`226`	`found = false;`
`225`		`- foreach(lc, ConvProcList)`
	`227`	`+ prev = NULL;`
	`228`	`+ for (lc = list_head(ConvProcList); lc; lc = next)`
`226`	`229`	`{`
`227`	`230`	`ConvProcInfo convinfo = (ConvProcInfo ) lfirst(lc);`
`228`	`231`
	`232`	`+ next = lnext(lc);`
	`233`	`+`
`229`	`234`	`if (convinfo->s_encoding == current_server_encoding &&`
`230`	`235`	`convinfo->c_encoding == encoding)`
`231`	`236`	`{`
`@@ -240,10 +245,13 @@ SetClientEncoding(int encoding)`
`240`	`245`	`else`
`241`	`246`	`{`
`242`	`247`	`/* Duplicate entry, release it */`
`243`		`- ConvProcList = list_delete_ptr(ConvProcList, convinfo);`
	`248`	`+ ConvProcList = list_delete_cell(ConvProcList, lc, prev);`
`244`	`249`	`pfree(convinfo);`
	`250`	`+ continue; /* prev mustn't advance */`
`245`	`251`	`}`
`246`	`252`	`}`
	`253`	`+`
	`254`	`+ prev = lc;`
`247`	`255`	`}`
`248`	`256`
`249`	`257`	`if (found)`