NotificationsYou must be signed in to change notification settings
Fork6
Star31

Commit6b87416

committed

Fix access-off-end-of-array in clog.c.

Sloppy loop coding in set_status_by_pages() resulted in fetching one arrayelement more than it should from the subxids[] array. The odds of thisresulting in SIGSEGV are pretty small, but we've certainly seen that happenwith similar mistakes elsewhere. While at it, we can get rid of an extraTransactionIdToPage() calculation per loop.Per report from David Binderman. Back-patch to all supported branches,since this code is quite old.Discussion:https://postgr.es/m/HE1PR0802MB2331CBA919CBFFF0C465EB429C710@HE1PR0802MB2331.eurprd08.prod.outlook.com

1 parentc3d9a66 commit6b87416Copy full SHA for 6b87416

File tree

1 file changed

-3

lines changed

src/backend/access/transam
- clog.c

1 file changed

-3

lines changed

`‎src/backend/access/transam/clog.c`

Lines changed: 9 additions & 3 deletions

Original file line number	Diff line number	Diff line change
`@@ -241,21 +241,27 @@ set_status_by_pages(int nsubxids, TransactionId *subxids,`
`241`	`241`	`intoffset=0;`
`242`	`242`	`inti=0;`
`243`	`243`
	`244`	`+Assert(nsubxids>0);/* else the pageno fetch above is unsafe */`
	`245`	`+`
`244`	`246`	`while (i<nsubxids)`
`245`	`247`	`{`
`246`	`248`	`intnum_on_page=0;`
	`249`	`+intnextpageno;`
`247`	`250`
`248`		`-while (TransactionIdToPage(subxids[i])==pageno&&i<nsubxids)`
	`251`	`+do`
`249`	`252`	`{`
	`253`	`+nextpageno=TransactionIdToPage(subxids[i]);`
	`254`	`+if (nextpageno!=pageno)`
	`255`	`+break;`
`250`	`256`	`num_on_page++;`
`251`	`257`	`i++;`
`252`		`-}`
	`258`	`+}while (i<nsubxids);`
`253`	`259`
`254`	`260`	`TransactionIdSetPageStatus(InvalidTransactionId,`
`255`	`261`	`num_on_page,subxids+offset,`
`256`	`262`	`status,lsn,pageno, false);`
`257`	`263`	`offset=i;`
`258`		`-pageno=TransactionIdToPage(subxids[offset]);`
	`264`	`+pageno=nextpageno;`
`259`	`265`	`}`
`260`	`266`	`}`
`261`	`267`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commit6b87416

File tree

1 file changed

1 file changed

`‎src/backend/access/transam/clog.c`

0 commit comments