forked frompostgres/postgres
- Notifications
You must be signed in to change notification settings - Fork6
Commit291e517
committed
pageinspect: Add more sanity checks to prevent out-of-bound reads
A couple of code paths use the special area on the page passed by thefunction caller, expecting to find some data in it. However, feedingan incorrect page can lead to out-of-bound reads when trying to accessthe page special area (like a heap page that has no special area,leading PageGetSpecialPointer() to grab a pointer outside the allocatedpage).The functions used for hash and btree indexes have some protectionalready against that, while some other functions using a relation OIDas argument would make sure that the access method involved is correct,but functions taking in input a raw page without knowing the relationthe page is attached to would run into problems.This commit improves the set of checks used in the code paths of BRIN,btree (including one check if a leaf page is found with a non-zerolevel), GIN and GiST to verify that the page given in input has aspecial area size that fits with each access method, which is donethough PageGetSpecialSize(), becore calling PageGetSpecialPointer().The scope of the checks done is limited to work with pages that onewould pass after getting a block with get_raw_page(), as it is possibleto craft byteas that could bypass existing code paths. Having too manychecks would also impact the usability of pageinspect, as the existingcode is very useful to look at the content details in a corrupted page,so the focus is really to avoid out-of-bound reads as this is never agood thing even with functions whose execution is limited tosuperusers.The safest approach could be to rework the functions so as these fetch ablock using a relation OID and a block number, but there are also caseswhere using a raw page is useful.Tests are added to cover all the code paths that needed such checks, andan error message for hash indexes is reworded to fit better with whatthis commit adds.Reported-By: Alexander LakhinAuthor: Julien Rouhaud, Michael PaquierDiscussion:https://postgr.es/m/16527-ef7606186f0610a1@postgresql.orgDiscussion:https://postgr.es/m/561e187b-3549-c8d5-03f5-525c14e65bd0@postgrespro.ruBackpatch-through: 101 parent404f493 commit291e517
File tree
15 files changed
+200
-30
lines changed- contrib/pageinspect
- expected
- sql
15 files changed
+200
-30
lines changedLines changed: 18 additions & 0 deletions
Original file line number | Diff line number | Diff line change | |
---|---|---|---|
| |||
58 | 58 |
| |
59 | 59 |
| |
60 | 60 |
| |
| 61 | + | |
| 62 | + | |
| 63 | + | |
| 64 | + | |
| 65 | + | |
| 66 | + | |
| 67 | + | |
| 68 | + | |
| 69 | + | |
61 | 70 |
| |
62 | 71 |
| |
63 | 72 |
| |
| |||
86 | 95 |
| |
87 | 96 |
| |
88 | 97 |
| |
| 98 | + | |
| 99 | + | |
| 100 | + | |
| 101 | + | |
| 102 | + | |
| 103 | + | |
| 104 | + | |
| 105 | + | |
| 106 | + | |
89 | 107 |
| |
90 | 108 |
| |
91 | 109 |
| |
|
Lines changed: 14 additions & 0 deletions
Original file line number | Diff line number | Diff line change | |
---|---|---|---|
| |||
613 | 613 |
| |
614 | 614 |
| |
615 | 615 |
| |
| 616 | + | |
| 617 | + | |
| 618 | + | |
| 619 | + | |
| 620 | + | |
| 621 | + | |
| 622 | + | |
| 623 | + | |
| 624 | + | |
616 | 625 |
| |
617 | 626 |
| |
618 | 627 |
| |
619 | 628 |
| |
620 | 629 |
| |
621 | 630 |
| |
622 | 631 |
| |
| 632 | + | |
| 633 | + | |
| 634 | + | |
| 635 | + | |
| 636 | + | |
623 | 637 |
| |
624 | 638 |
| |
625 | 639 |
| |
|
Lines changed: 10 additions & 0 deletions
Original file line number | Diff line number | Diff line change | |
---|---|---|---|
| |||
52 | 52 |
| |
53 | 53 |
| |
54 | 54 |
| |
| 55 | + | |
| 56 | + | |
| 57 | + | |
| 58 | + | |
| 59 | + | |
| 60 | + | |
| 61 | + | |
| 62 | + | |
| 63 | + | |
| 64 | + | |
55 | 65 |
|
Lines changed: 18 additions & 4 deletions
Original file line number | Diff line number | Diff line change | |
---|---|---|---|
| |||
1 |
| - | |
2 |
| - | |
| 1 | + | |
| 2 | + | |
3 | 3 |
| |
4 | 4 |
| |
5 | 5 |
| |
| |||
78 | 78 |
| |
79 | 79 |
| |
80 | 80 |
| |
81 |
| - | |
| 81 | + | |
| 82 | + | |
| 83 | + | |
| 84 | + | |
| 85 | + | |
| 86 | + | |
| 87 | + | |
| 88 | + | |
82 | 89 |
| |
83 |
| - | |
| 90 | + | |
84 | 91 |
| |
| 92 | + | |
85 | 93 |
| |
86 | 94 |
| |
| 95 | + | |
| 96 | + | |
| 97 | + | |
| 98 | + | |
| 99 | + | |
| 100 | + | |
87 | 101 |
| |
88 | 102 |
|
Lines changed: 11 additions & 3 deletions
Original file line number | Diff line number | Diff line change | |
---|---|---|---|
| |||
35 | 35 |
| |
36 | 36 |
| |
37 | 37 |
| |
38 |
| - | |
39 |
| - | |
| 38 | + | |
40 | 39 |
| |
41 |
| - | |
| 40 | + | |
42 | 41 |
| |
| 42 | + | |
43 | 43 |
| |
44 | 44 |
| |
45 | 45 |
| |
46 | 46 |
| |
47 | 47 |
| |
48 | 48 |
| |
| 49 | + | |
| 50 | + | |
| 51 | + | |
| 52 | + | |
| 53 | + | |
| 54 | + | |
| 55 | + | |
49 | 56 |
| |
| 57 | + |
Lines changed: 10 additions & 2 deletions
Original file line number | Diff line number | Diff line change | |
---|---|---|---|
| |||
68 | 68 |
| |
69 | 69 |
| |
70 | 70 |
| |
71 |
| - | |
| 71 | + | |
72 | 72 |
| |
73 |
| - | |
| 73 | + | |
74 | 74 |
| |
| 75 | + | |
75 | 76 |
| |
76 | 77 |
| |
77 | 78 |
| |
78 | 79 |
| |
79 | 80 |
| |
80 | 81 |
| |
| 82 | + | |
| 83 | + | |
| 84 | + | |
| 85 | + | |
| 86 | + | |
| 87 | + | |
| 88 | + | |
81 | 89 |
| |
82 | 90 |
|
Lines changed: 12 additions & 2 deletions
Original file line number | Diff line number | Diff line change | |
---|---|---|---|
| |||
167 | 167 |
| |
168 | 168 |
| |
169 | 169 |
| |
170 |
| - | |
| 170 | + | |
171 | 171 |
| |
172 |
| - | |
| 172 | + | |
173 | 173 |
| |
| 174 | + | |
174 | 175 |
| |
175 | 176 |
| |
176 | 177 |
| |
| |||
179 | 180 |
| |
180 | 181 |
| |
181 | 182 |
| |
| 183 | + | |
| 184 | + | |
| 185 | + | |
| 186 | + | |
| 187 | + | |
| 188 | + | |
| 189 | + | |
| 190 | + | |
| 191 | + | |
182 | 192 |
| |
183 | 193 |
|
Lines changed: 19 additions & 3 deletions
Original file line number | Diff line number | Diff line change | |
---|---|---|---|
| |||
49 | 49 |
| |
50 | 50 |
| |
51 | 51 |
| |
| 52 | + | |
| 53 | + | |
| 54 | + | |
| 55 | + | |
| 56 | + | |
| 57 | + | |
| 58 | + | |
| 59 | + | |
52 | 60 |
| |
53 | 61 |
| |
54 | 62 |
| |
| |||
107 | 115 |
| |
108 | 116 |
| |
109 | 117 |
| |
| 118 | + | |
| 119 | + | |
| 120 | + | |
| 121 | + | |
| 122 | + | |
| 123 | + | |
| 124 | + | |
| 125 | + | |
110 | 126 |
| |
111 | 127 |
| |
112 | 128 |
| |
| |||
188 | 204 |
| |
189 | 205 |
| |
190 | 206 |
| |
191 |
| - | |
192 |
| - | |
193 |
| - | |
| 207 | + | |
| 208 | + | |
| 209 | + | |
194 | 210 |
| |
195 | 211 |
| |
196 | 212 |
| |
|
Lines changed: 35 additions & 0 deletions
Original file line number | Diff line number | Diff line change | |
---|---|---|---|
| |||
55 | 55 |
| |
56 | 56 |
| |
57 | 57 |
| |
| 58 | + | |
| 59 | + | |
| 60 | + | |
| 61 | + | |
| 62 | + | |
| 63 | + | |
| 64 | + | |
| 65 | + | |
| 66 | + | |
58 | 67 |
| |
| 68 | + | |
| 69 | + | |
| 70 | + | |
| 71 | + | |
| 72 | + | |
| 73 | + | |
| 74 | + | |
59 | 75 |
| |
60 | 76 |
| |
61 | 77 |
| |
| |||
101 | 117 |
| |
102 | 118 |
| |
103 | 119 |
| |
| 120 | + | |
104 | 121 |
| |
105 | 122 |
| |
106 | 123 |
| |
| |||
113 | 130 |
| |
114 | 131 |
| |
115 | 132 |
| |
| 133 | + | |
| 134 | + | |
| 135 | + | |
| 136 | + | |
| 137 | + | |
| 138 | + | |
| 139 | + | |
| 140 | + | |
| 141 | + | |
| 142 | + | |
| 143 | + | |
| 144 | + | |
| 145 | + | |
| 146 | + | |
| 147 | + | |
| 148 | + | |
| 149 | + | |
| 150 | + | |
116 | 151 |
| |
117 | 152 |
| |
118 | 153 |
| |
|
Lines changed: 7 additions & 4 deletions
Original file line number | Diff line number | Diff line change | |
---|---|---|---|
| |||
66 | 66 |
| |
67 | 67 |
| |
68 | 68 |
| |
69 |
| - | |
70 |
| - | |
| 69 | + | |
| 70 | + | |
| 71 | + | |
| 72 | + | |
| 73 | + | |
71 | 74 |
| |
72 | 75 |
| |
73 | 76 |
| |
74 | 77 |
| |
75 | 78 |
| |
76 |
| - | |
| 79 | + | |
77 | 80 |
| |
78 | 81 |
| |
79 | 82 |
| |
| |||
134 | 137 |
| |
135 | 138 |
| |
136 | 139 |
| |
137 |
| - | |
| 140 | + | |
138 | 141 |
| |
139 | 142 |
| |
140 | 143 |
| |
|
Lines changed: 8 additions & 0 deletions
Original file line number | Diff line number | Diff line change | |
---|---|---|---|
| |||
19 | 19 |
| |
20 | 20 |
| |
21 | 21 |
| |
| 22 | + | |
| 23 | + | |
| 24 | + | |
| 25 | + | |
| 26 | + | |
| 27 | + | |
| 28 | + | |
| 29 | + | |
22 | 30 |
|
Lines changed: 14 additions & 4 deletions
Original file line number | Diff line number | Diff line change | |
---|---|---|---|
| |||
1 |
| - | |
2 |
| - | |
| 1 | + | |
| 2 | + | |
3 | 3 |
| |
4 | 4 |
| |
5 | 5 |
| |
| |||
26 | 26 |
| |
27 | 27 |
| |
28 | 28 |
| |
| 29 | + | |
| 30 | + | |
| 31 | + | |
| 32 | + | |
| 33 | + | |
29 | 34 |
| |
30 |
| - | |
| 35 | + | |
31 | 36 |
| |
32 |
| - | |
| 37 | + | |
33 | 38 |
| |
| 39 | + | |
34 | 40 |
| |
| 41 | + | |
| 42 | + | |
| 43 | + | |
| 44 | + | |
35 | 45 |
| |
36 | 46 |
| |
37 | 47 |
|
Lines changed: 9 additions & 4 deletions
Original file line number | Diff line number | Diff line change | |
---|---|---|---|
| |||
18 | 18 |
| |
19 | 19 |
| |
20 | 20 |
| |
21 |
| - | |
22 |
| - | |
23 |
| - | |
| 21 | + | |
24 | 22 |
| |
25 |
| - | |
| 23 | + | |
26 | 24 |
| |
| 25 | + | |
27 | 26 |
| |
28 | 27 |
| |
29 | 28 |
| |
| 29 | + | |
| 30 | + | |
| 31 | + | |
| 32 | + | |
30 | 33 |
| |
| 34 | + | |
| 35 | + |
0 commit comments
Comments
(0)