Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitb7ef58a

Browse files
committed
Add defenses against integer overflow in dynahash numbuckets calculations.
The dynahash code requires the number of buckets in a hash table to fitin an int; but since we calculate the desired hash table size dynamically,there are various scenarios where we might calculate too large a value.The resulting overflow can lead to infinite loops, division-by-zerocrashes, etc. I (tgl) had previously installed some defenses against thatin commit299d171, but that covered only onecall path. Moreover it worked by limiting the request size to work_mem,but in a 64-bit machine it's possible to set work_mem high enough that theproblem appears anyway. So let's fix the problem at the root by installinglimits in the dynahash.c functions themselves.Trouble report and patch by Jeff Davis.
1 parent175f7a3 commitb7ef58a

File tree

2 files changed

+41
-12
lines changed

2 files changed

+41
-12
lines changed

‎src/backend/executor/nodeHash.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -431,7 +431,9 @@ ExecChooseHashTableSize(double ntuples, int tupwidth,
431431
* Both nbuckets and nbatch must be powers of 2 to make
432432
* ExecHashGetBucketAndBatch fast.We already fixed nbatch; now inflate
433433
* nbuckets to the next larger power of 2.We also force nbuckets to not
434-
* be real small, by starting the search at 2^10.
434+
* be real small, by starting the search at 2^10. (Note: above we made
435+
* sure that nbuckets is not more than INT_MAX / 2, so this loop cannot
436+
* overflow, nor can the final shift to recalculate nbuckets.)
435437
*/
436438
i=10;
437439
while ((1 <<i)<nbuckets)

‎src/backend/utils/hash/dynahash.c

Lines changed: 38 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,8 @@
6363

6464
#include"postgres.h"
6565

66+
#include<limits.h>
67+
6668
#include"access/xact.h"
6769
#include"storage/shmem.h"
6870
#include"storage/spin.h"
@@ -199,6 +201,8 @@ static void hdefault(HTAB *hashp);
199201
staticintchoose_nelem_alloc(Sizeentrysize);
200202
staticboolinit_htab(HTAB*hashp,longnelem);
201203
staticvoidhash_corrupted(HTAB*hashp);
204+
staticlongnext_pow2_long(longnum);
205+
staticintnext_pow2_int(longnum);
202206
staticvoidregister_seq_scan(HTAB*hashp);
203207
staticvoidderegister_seq_scan(HTAB*hashp);
204208
staticboolhas_seq_scans(HTAB*hashp);
@@ -373,8 +377,13 @@ hash_create(const char *tabname, long nelem, HASHCTL *info, int flags)
373377
{
374378
/* Doesn't make sense to partition a local hash table */
375379
Assert(flags&HASH_SHARED_MEM);
376-
/* # of partitions had better be a power of 2 */
377-
Assert(info->num_partitions== (1L <<my_log2(info->num_partitions)));
380+
381+
/*
382+
* The number of partitions had better be a power of 2. Also, it must
383+
* be less than INT_MAX (see init_htab()), so call the int version of
384+
* next_pow2.
385+
*/
386+
Assert(info->num_partitions==next_pow2_int(info->num_partitions));
378387

379388
hctl->num_partitions=info->num_partitions;
380389
}
@@ -515,7 +524,6 @@ init_htab(HTAB *hashp, long nelem)
515524
{
516525
HASHHDR*hctl=hashp->hctl;
517526
HASHSEGMENT*segp;
518-
longlnbuckets;
519527
intnbuckets;
520528
intnsegs;
521529

@@ -530,9 +538,7 @@ init_htab(HTAB *hashp, long nelem)
530538
* number of buckets. Allocate space for the next greater power of two
531539
* number of buckets
532540
*/
533-
lnbuckets= (nelem-1) /hctl->ffactor+1;
534-
535-
nbuckets=1 <<my_log2(lnbuckets);
541+
nbuckets=next_pow2_int((nelem-1) /hctl->ffactor+1);
536542

537543
/*
538544
* In a partitioned table, nbuckets must be at least equal to
@@ -550,7 +556,7 @@ init_htab(HTAB *hashp, long nelem)
550556
* Figure number of directory segments needed, round up to a power of 2
551557
*/
552558
nsegs= (nbuckets-1) /hctl->ssize+1;
553-
nsegs=1 <<my_log2(nsegs);
559+
nsegs=next_pow2_int(nsegs);
554560

555561
/*
556562
* Make sure directory is big enough. If pre-allocated directory is too
@@ -620,9 +626,9 @@ hash_estimate_size(long num_entries, Size entrysize)
620626
elementAllocCnt;
621627

622628
/* estimate number of buckets wanted */
623-
nBuckets=1L <<my_log2((num_entries-1) /DEF_FFACTOR+1);
629+
nBuckets=next_pow2_long((num_entries-1) /DEF_FFACTOR+1);
624630
/* # of segments needed for nBuckets */
625-
nSegments=1L <<my_log2((nBuckets-1) /DEF_SEGSIZE+1);
631+
nSegments=next_pow2_long((nBuckets-1) /DEF_SEGSIZE+1);
626632
/* directory entries */
627633
nDirEntries=DEF_DIRSIZE;
628634
while (nDirEntries<nSegments)
@@ -663,9 +669,9 @@ hash_select_dirsize(long num_entries)
663669
nDirEntries;
664670

665671
/* estimate number of buckets wanted */
666-
nBuckets=1L <<my_log2((num_entries-1) /DEF_FFACTOR+1);
672+
nBuckets=next_pow2_long((num_entries-1) /DEF_FFACTOR+1);
667673
/* # of segments needed for nBuckets */
668-
nSegments=1L <<my_log2((nBuckets-1) /DEF_SEGSIZE+1);
674+
nSegments=next_pow2_long((nBuckets-1) /DEF_SEGSIZE+1);
669675
/* directory entries */
670676
nDirEntries=DEF_DIRSIZE;
671677
while (nDirEntries<nSegments)
@@ -1397,11 +1403,32 @@ my_log2(long num)
13971403
inti;
13981404
longlimit;
13991405

1406+
/* guard against too-large input, which would put us into infinite loop */
1407+
if (num>LONG_MAX /2)
1408+
num=LONG_MAX /2;
1409+
14001410
for (i=0,limit=1;limit<num;i++,limit <<=1)
14011411
;
14021412
returni;
14031413
}
14041414

1415+
/* calculate first power of 2 >= num, bounded to what will fit in a long */
1416+
staticlong
1417+
next_pow2_long(longnum)
1418+
{
1419+
/* my_log2's internal range check is sufficient */
1420+
return1L <<my_log2(num);
1421+
}
1422+
1423+
/* calculate first power of 2 >= num, bounded to what will fit in an int */
1424+
staticint
1425+
next_pow2_int(longnum)
1426+
{
1427+
if (num>INT_MAX /2)
1428+
num=INT_MAX /2;
1429+
return1 <<my_log2(num);
1430+
}
1431+
14051432

14061433
/************************* SEQ SCAN TRACKING ************************/
14071434

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp