NotificationsYou must be signed in to change notification settings
Fork5.2k
Star19k

Commit8ce7948

committed

read_stream: Fix overflow hazard with large shared buffers

If the limit returned by GetAdditionalPinLimit() is large, the buffer_limitvariable in read_stream_start_pending_read() can overflow. While the code iscareful to limit buffer_limit PG_INT16_MAX, we subsequently add the number offorwarded buffers.The overflow can lead to assertion failures, crashes or wrong query resultswhen using large shared buffers.It seems easier to avoid this if we make the buffer_limit variable an int,instead of an int16. Do so, and clamp buffer_limit after adding the number offorwarded buffers.It's possible we might want to address this and related issues more widely bychanging to int instead of int16 more widely, but since the consequences ofthis bug can be confusing, it seems better to fix it now.This bug was introduced ined0b87c.Discussion:https://postgr.es/m/ewvz3cbtlhrwqk7h6ca6cctiqh7r64ol3pzb3iyjycn2r5nxk5@tnhw3a5zatlr

1 parent717d0e8 commit8ce7948Copy full SHA for 8ce7948

File tree

1 file changed

-1

lines changed

src/backend/storage/aio
- read_stream.c

1 file changed

-1

lines changed

`‎src/backend/storage/aio/read_stream.c‎`

Lines changed: 4 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -237,7 +237,7 @@ read_stream_start_pending_read(ReadStream *stream)`
`237`	`237`	`int16io_index;`
`238`	`238`	`int16overflow;`
`239`	`239`	`int16buffer_index;`
`240`		`-int16buffer_limit;`
	`240`	`+intbuffer_limit;`
`241`	`241`
`242`	`242`	`/* This should only be called with a pending read. */`
`243`	`243`	`Assert(stream->pending_read_nblocks>0);`
`@@ -294,7 +294,10 @@ read_stream_start_pending_read(ReadStream *stream)`
`294`	`294`	`else`
`295`	`295`	`buffer_limit=Min(GetAdditionalPinLimit(),PG_INT16_MAX);`
`296`	`296`	`Assert(stream->forwarded_buffers <=stream->pending_read_nblocks);`
	`297`	`+`
`297`	`298`	`buffer_limit+=stream->forwarded_buffers;`
	`299`	`+buffer_limit=Min(buffer_limit,PG_INT16_MAX);`
	`300`	`+`
`298`	`301`	`if (buffer_limit==0&&stream->pinned_buffers==0)`
`299`	`302`	`buffer_limit=1;/* guarantee progress */`
`300`	`303`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commit8ce7948

File tree

1 file changed

1 file changed

`‎src/backend/storage/aio/read_stream.c‎`

0 commit comments