Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit1bbbe14

Browse files
committed
Fix oversights in array manipulation.
The nested-arrays code path in ExecEvalArrayExpr() used palloc toallocate the result array, whereas every other array-creating functionhas used palloc0 since18c0b4e. This mostly works, but unused bitspast the end of the nulls bitmap may end up undefined. That causesvalgrind complaints with -DWRITE_READ_PARSE_PLAN_TREES, and couldcause planner misbehavior as cited in18c0b4e. There seems no verygood reason why we should strive to avoid palloc0 in just this one case,so fix it the easy way with s/palloc/palloc0/.While looking at that I noted that we also failed to check for overflowof "nbytes" and "nitems" while summing the sizes of the sub-arrays,potentially allowing a crash due to undersized output allocation.For "nbytes", follow the policy used by other array-munging code ofchecking for overflow after each addition. (As elsewhere, the lastaddition of the array's overhead space doesn't need an extra check,since palloc itself will catch a value between 1Gb and 2Gb.)For "nitems", there's no very good reason to sum the inputs at all,since we can perfectly well use ArrayGetNItems' result instead ofignoring it.Per discussion of this bug, also remove redundant zeroing of thenulls bitmap in array_set_element and array_set_slice.Patch by Alexander Lakhin and myself, per bug #17858 from AlexanderLakhin; thanks also to Richard Guo. These bugs are a dozen years old,so back-patch to all supported branches.Discussion:https://postgr.es/m/17858-8fd287fd3663d051@postgresql.org
1 parentbe52fff commit1bbbe14

File tree

2 files changed

+11
-8
lines changed

2 files changed

+11
-8
lines changed

‎src/backend/executor/execExprInterp.c

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2689,7 +2689,7 @@ ExecEvalArrayExpr(ExprState *state, ExprEvalStep *op)
26892689
{
26902690
/* Must be nested array expressions */
26912691
intnbytes=0;
2692-
intnitems=0;
2692+
intnitems;
26932693
intouter_nelems=0;
26942694
intelem_ndims=0;
26952695
int*elem_dims=NULL;
@@ -2784,9 +2784,14 @@ ExecEvalArrayExpr(ExprState *state, ExprEvalStep *op)
27842784
subbitmaps[outer_nelems]=ARR_NULLBITMAP(array);
27852785
subbytes[outer_nelems]=ARR_SIZE(array)-ARR_DATA_OFFSET(array);
27862786
nbytes+=subbytes[outer_nelems];
2787+
/* check for overflow of total request */
2788+
if (!AllocSizeIsValid(nbytes))
2789+
ereport(ERROR,
2790+
(errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
2791+
errmsg("array size exceeds the maximum allowed (%d)",
2792+
(int)MaxAllocSize)));
27872793
subnitems[outer_nelems]=ArrayGetNItems(this_ndims,
27882794
ARR_DIMS(array));
2789-
nitems+=subnitems[outer_nelems];
27902795
havenulls |=ARR_HASNULL(array);
27912796
outer_nelems++;
27922797
}
@@ -2820,7 +2825,7 @@ ExecEvalArrayExpr(ExprState *state, ExprEvalStep *op)
28202825
}
28212826

28222827
/* check for subscript overflow */
2823-
(void)ArrayGetNItems(ndims,dims);
2828+
nitems=ArrayGetNItems(ndims,dims);
28242829
ArrayCheckBounds(ndims,dims,lbs);
28252830

28262831
if (havenulls)
@@ -2834,7 +2839,7 @@ ExecEvalArrayExpr(ExprState *state, ExprEvalStep *op)
28342839
nbytes+=ARR_OVERHEAD_NONULLS(ndims);
28352840
}
28362841

2837-
result= (ArrayType*)palloc(nbytes);
2842+
result= (ArrayType*)palloc0(nbytes);
28382843
SET_VARSIZE(result,nbytes);
28392844
result->ndim=ndims;
28402845
result->dataoffset=dataoffset;

‎src/backend/utils/adt/arrayfuncs.c

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2436,8 +2436,7 @@ array_set_element(Datum arraydatum,
24362436
{
24372437
bits8*newnullbitmap=ARR_NULLBITMAP(newarray);
24382438

2439-
/* Zero the bitmap to take care of marking inserted positions null */
2440-
MemSet(newnullbitmap,0, (newnitems+7) /8);
2439+
/* palloc0 above already marked any inserted positions as nulls */
24412440
/* Fix the inserted value */
24422441
if (addedafter)
24432442
array_set_isnull(newnullbitmap,newnitems-1,isNull);
@@ -3049,8 +3048,7 @@ array_set_slice(Datum arraydatum,
30493048
bits8*newnullbitmap=ARR_NULLBITMAP(newarray);
30503049
bits8*oldnullbitmap=ARR_NULLBITMAP(array);
30513050

3052-
/* Zero the bitmap to handle marking inserted positions null */
3053-
MemSet(newnullbitmap,0, (nitems+7) /8);
3051+
/* palloc0 above already marked any inserted positions as nulls */
30543052
array_bitmap_copy(newnullbitmap,addedbefore,
30553053
oldnullbitmap,0,
30563054
itemsbefore);

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp