hcq/oceanbase
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

stmt is double-freed

Browse Source
This commit is contained in:
sw0
2022-01-04 19:52:15 +08:00
committed by LINxiansheng
parent 5df0c70862
commit bfa4cc4e12
2 changed files with 26 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
src/sql/resolver/ob_stmt.cpp
View File

@ -338,8 +338,31 @@ ObQueryCtx* ObStmtFactory::get_query_ctx()
return query_ctx_; return query_ctx_;
} }
template <> int ObStmtFactory::free_stmt(ObSelectStmt *stmt)
int ObStmtFactory::create_stmt<ObSelectStmt>(ObSelectStmt*& stmt) {
int ret = OB_SUCCESS;
ObObjNode<ObStmt*> *del_node = NULL;
DLIST_FOREACH_NORET(node, stmt_store_.get_obj_list()) {
if (node != NULL && node->get_obj() == stmt) {
del_node = node;
break;
}
}
if (OB_SUCC(ret)) {
if (OB_ISNULL(stmt_store_.get_obj_list().remove(del_node))) {
ret = OB_ERR_UNEXPECTED;
LOG_WARN("node is not found", K(ret));
} else if (OB_FAIL(free_list_.store_obj(stmt))) {
LOG_WARN("failed to store stmt", K(ret));
} else {
stmt->~ObSelectStmt();
}
}
return ret;
}
template<>
int ObStmtFactory::create_stmt<ObSelectStmt>(ObSelectStmt *&stmt)
{ {
int ret = common::OB_SUCCESS; int ret = common::OB_SUCCESS;
void* ptr = NULL; void* ptr = NULL;
@ -347,7 +370,6 @@ int ObStmtFactory::create_stmt<ObSelectStmt>(ObSelectStmt*& stmt)
ptr = allocator_.alloc(sizeof(ObSelectStmt)); ptr = allocator_.alloc(sizeof(ObSelectStmt));
} else { } else {
stmt = free_list_.get_obj_list().remove_first()->get_obj(); stmt = free_list_.get_obj_list().remove_first()->get_obj();
stmt->~ObSelectStmt();
ptr = stmt; ptr = stmt;
} }
stmt = NULL; stmt = NULL;

12
src/sql/resolver/ob_stmt.h
View File

@ -594,17 +594,7 @@ public:
return ret; return ret;
} }
inline int free_stmt(ObSelectStmt* stmt) int free_stmt(ObSelectStmt *stmt);
{
int ret = common::OB_SUCCESS;
if (OB_UNLIKELY(NULL == stmt)) {
ret = OB_ERR_UNEXPECTED;
SQL_RESV_LOG(WARN, "unexpected null");
} else if (OB_FAIL(free_list_.store_obj(stmt))) {
SQL_RESV_LOG(WARN, "store stmt failed", K(ret));
}
return ret;
}
void destory(); void destory();
/** /**