Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit8036097

Browse files
committed
Avoid possibly accessing off the end of memory in examine_attribute().
Since the last couple of columns of pg_type are often NULL,sizeof(FormData_pg_type) can be an overestimate of the actual size of thetuple data part. Therefore memcpy'ing that much out of the catalog cache,as analyze.c was doing, poses a small risk of copying past the end ofmemory and incurring SIGSEGV. No such crash has been identified in thefield, but we've certainly seen the equivalent happen in other code paths,so patch this one all the way back.Per valgrind testing by Noah Misch, though this is not his proposed patch.I chose to use SearchSysCacheCopy1 rather than inventing special-purposeinfrastructure for copying only the minimal part of a pg_type tuple.
1 parent1426abb commit8036097

File tree

1 file changed

+5
-7
lines changed

1 file changed

+5
-7
lines changed

‎src/backend/commands/analyze.c

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -655,14 +655,12 @@ examine_attribute(Relation onerel, int attnum)
655655
stats= (VacAttrStats*)palloc0(sizeof(VacAttrStats));
656656
stats->attr= (Form_pg_attribute)palloc(ATTRIBUTE_TUPLE_SIZE);
657657
memcpy(stats->attr,attr,ATTRIBUTE_TUPLE_SIZE);
658-
typtuple=SearchSysCache(TYPEOID,
659-
ObjectIdGetDatum(attr->atttypid),
660-
0,0,0);
658+
typtuple=SearchSysCacheCopy(TYPEOID,
659+
ObjectIdGetDatum(attr->atttypid),
660+
0,0,0);
661661
if (!HeapTupleIsValid(typtuple))
662662
elog(ERROR,"cache lookup failed for type %u",attr->atttypid);
663-
stats->attrtype= (Form_pg_type)palloc(sizeof(FormData_pg_type));
664-
memcpy(stats->attrtype,GETSTRUCT(typtuple),sizeof(FormData_pg_type));
665-
ReleaseSysCache(typtuple);
663+
stats->attrtype= (Form_pg_type)GETSTRUCT(typtuple);
666664
stats->anl_context=anl_context;
667665
stats->tupattnum=attnum;
668666

@@ -678,7 +676,7 @@ examine_attribute(Relation onerel, int attnum)
678676

679677
if (!ok||stats->compute_stats==NULL||stats->minrows <=0)
680678
{
681-
pfree(stats->attrtype);
679+
heap_freetuple(typtuple);
682680
pfree(stats->attr);
683681
pfree(stats);
684682
returnNULL;

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp