Merge pull request #2222 from citusdata/fix_insert_select

Fix use-after-free that may occur for INSERT..SELECT in prepared statements

cr: @jasonmp85

src/backend/distributed/executor/insert_select_executor.c

@@ -101,6 +101,7 @@ ExecuteSelectIntoRelation(Oid targetRelationId, List *insertTargetList,
 	int partitionColumnIndex = -1;
 
 	CitusCopyDestReceiver *copyDest = NULL;
+	Query *queryCopy = NULL;
 
 	partitionMethod = PartitionMethod(targetRelationId);
 	if (partitionMethod == DISTRIBUTE_BY_NONE)
@@ -135,7 +136,14 @@ ExecuteSelectIntoRelation(Oid targetRelationId, List *insertTargetList,
 										   partitionColumnIndex, executorState,
 										   stopOnFailure);
 
-	ExecuteQueryIntoDestReceiver(selectQuery, paramListInfo, (DestReceiver *) copyDest);
+	/*
+	 * Make a copy of the query, since ExecuteQueryIntoDestReceiver may scribble on it
+	 * and we want it to be replanned every time if it is stored in a prepared
+	 * statement.
+	 */
+	queryCopy = copyObject(selectQuery);
+
+	ExecuteQueryIntoDestReceiver(queryCopy, paramListInfo, (DestReceiver *) copyDest);
 
 	executorState->es_processed = copyDest->tuplesSent;
 

src/test/regress/expected/multi_insert_select.out

@@ -2722,6 +2722,19 @@ SELECT * FROM coerce_agg;
        2 | {2,2,2}
 (2 rows)
 
+-- INSERT..SELECT + prepared statements + recursive planning
+BEGIN;
+PREPARE prepared_recursive_insert_select AS 
+INSERT INTO users_table 
+SELECT * FROM users_table 
+WHERE value_1 IN (SELECT value_2 FROM events_table OFFSET 0);
+EXECUTE prepared_recursive_insert_select;
+EXECUTE prepared_recursive_insert_select;
+EXECUTE prepared_recursive_insert_select;
+EXECUTE prepared_recursive_insert_select;
+EXECUTE prepared_recursive_insert_select;
+EXECUTE prepared_recursive_insert_select;
+ROLLBACK;
 -- wrap in a transaction to improve performance
 BEGIN;
 DROP TABLE coerce_events;

src/test/regress/sql/multi_insert_select.sql

@@ -2090,6 +2090,20 @@ LIMIT 5;
 
 SELECT * FROM coerce_agg;
 
+-- INSERT..SELECT + prepared statements + recursive planning
+BEGIN;
+PREPARE prepared_recursive_insert_select AS 
+INSERT INTO users_table 
+SELECT * FROM users_table 
+WHERE value_1 IN (SELECT value_2 FROM events_table OFFSET 0);
+EXECUTE prepared_recursive_insert_select;
+EXECUTE prepared_recursive_insert_select;
+EXECUTE prepared_recursive_insert_select;
+EXECUTE prepared_recursive_insert_select;
+EXECUTE prepared_recursive_insert_select;
+EXECUTE prepared_recursive_insert_select;
+ROLLBACK;
+
 -- wrap in a transaction to improve performance
 BEGIN;
 DROP TABLE coerce_events;