Skip to content

Commit 78c348b

Browse files
authored
Fix corruption when entry->buffer changed to nonleaf while unlocked. (#145)
The entry->buffer pointer is retrieved, but the underlying buffer can be modified by another thread before it's used, leading to invalid memory access and a segmentation fault. Now we check this case and return from the function.
1 parent 2b0eb97 commit 78c348b

File tree

1 file changed

+8
-1
lines changed

1 file changed

+8
-1
lines changed

src/rumget.c

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -889,7 +889,14 @@ entryGetNextItem(RumState * rumstate, RumScanEntry entry, Snapshot snapshot)
889889

890890
LockBuffer(entry->buffer, RUM_SHARE);
891891
page = BufferGetPage(entry->buffer);
892-
892+
if (!RumPageIsLeaf(page))
893+
{
894+
/*
895+
* Root page becomes non-leaf while we unlock it. just return.
896+
*/
897+
LockBuffer(entry->buffer, RUM_UNLOCK);
898+
return;
899+
}
893900
PredicateLockPage(rumstate->index, BufferGetBlockNumber(entry->buffer), snapshot);
894901

895902
if (scanPage(rumstate, entry, &entry->curItem, false))

0 commit comments

Comments
 (0)