Fix segfault in certain case.

The scenario is something like:

1) a named statement is created.
2) DEALLOCATE removes it.
3) an erroneous query is executed.

In #2, "sent message" for the named statement is removed but
"uncompleted_message" is left. Then after #3, in ReadyForQuery()
uncompleted_message is added and removed. However, storage for the
uncompleted_message has been already freed in #2, and it causes a
segfault.

Fix is, in SimpleQuery() set NULL to uncompleted_message if it's not
PREPARE command so that ReadyForQuery() does not try to remove the
already removed message.

Per bug 546.

Here is a minimum test case.

'P'	"_plan0x7f2d465db530"	"SELECT 1"	0
'S'
'Y'
'Q'	"DEALLOCATE _plan0x7f2d465db530"
'Y'
'Q'	"CREATE INDEX users_auth_id_index ON non_existing_table ( auth_id )"
'Y'
'X'

diff --git a/src/protocol/pool_proto_modules.c b/src/protocol/pool_proto_modules.c
index 91a120f7104eb155f8d5ebb94327d6958d676d52..dd429518268d58fa08d9c9896ba2dd40f04b362f 100644 (file)
--- a/src/protocol/pool_proto_modules.c
+++ b/src/protocol/pool_proto_modules.c
@@ -493,6 +493,8 @@ POOL_STATUS SimpleQuery(POOL_CONNECTION *frontend,
                                                                                   query_context);
                        session_context->uncompleted_message =  msg;
                }
+               else
+                       session_context->uncompleted_message = NULL;
        }