Vladimir Davydov
authored
space_truncate allocates a statement on the stack which is grossly incorrect as the stack may be purged once the function returns while box_process_rw expects the statement to be valid until the end of the transaction. By happy accident, it worked fine until commit 1f7b0d65 ("Require for single statement not autocommit in case of ddl"), which made it possible to run this function from a transaction and hence increased the probability of hitting the use-after-free bug. The fix is trivial: allocate a truncation statement on the region. Fixes commit 353bcdc5 ("Rework space truncation"). Closes #4093
Name | Last commit | Last update |
---|