Fix use-after-free error reported by Neil Conway.

diff --git a/src/bin/psql/common.c b/src/bin/psql/common.c
index c35d3c3eef5d8ab7bca3dd875143492df82f9abf..fe7d508a438541ad2ed1b4d94c49eaeafa1bf1d6 100644 (file)
--- a/src/bin/psql/common.c
+++ b/src/bin/psql/common.c
@@ -3,7 +3,7 @@
  *
  * Copyright (c) 2000-2006, PostgreSQL Global Development Group
  *
- * $PostgreSQL: pgsql/src/bin/psql/common.c,v 1.119 2006/06/14 16:49:02 tgl Exp $
+ * $PostgreSQL: pgsql/src/bin/psql/common.c,v 1.120 2006/06/30 15:06:05 alvherre Exp $
  */
 #include "postgres_fe.h"
 #include "common.h"
@@ -875,19 +875,19 @@ SendQuery(const char *query)
        if (OK)
                OK = PrintQueryResults(results);
 
-       PQclear(results);
-
        /* If we made a temporary savepoint, possibly release/rollback */
        if (on_error_rollback_savepoint)
        {
+               PGresult   *svptres;
+
                transaction_status = PQtransactionStatus(pset.db);
 
                /* We always rollback on an error */
                if (transaction_status == PQTRANS_INERROR)
-                       results = PQexec(pset.db, "ROLLBACK TO pg_psql_temporary_savepoint");
+                       svptres = PQexec(pset.db, "ROLLBACK TO pg_psql_temporary_savepoint");
                /* If they are no longer in a transaction, then do nothing */
                else if (transaction_status != PQTRANS_INTRANS)
-                       results = NULL;
+                       svptres = NULL;
                else
                {
                        /*
@@ -898,20 +898,22 @@ SendQuery(const char *query)
                        if (strcmp(PQcmdStatus(results), "SAVEPOINT") == 0 ||
                                strcmp(PQcmdStatus(results), "RELEASE") == 0 ||
                                strcmp(PQcmdStatus(results), "ROLLBACK") == 0)
-                               results = NULL;
+                               svptres = NULL;
                        else
-                               results = PQexec(pset.db, "RELEASE pg_psql_temporary_savepoint");
+                               svptres = PQexec(pset.db, "RELEASE pg_psql_temporary_savepoint");
                }
-               if (PQresultStatus(results) != PGRES_COMMAND_OK)
+               if (svptres && PQresultStatus(svptres) != PGRES_COMMAND_OK)
                {
                        psql_error("%s", PQerrorMessage(pset.db));
                        PQclear(results);
+                       PQclear(svptres);
                        ResetCancelConn();
                        return false;
                }
-               PQclear(results);
        }
 
+       PQclear(results);
+
        /* Possible microtiming output */
        if (OK && pset.timing)
                printf(_("Time: %.3f ms\n"), DIFF_MSEC(&after, &before));