Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit7c48734

Browse files
committed
Fix oversights in array manipulation.
The nested-arrays code path in ExecEvalArrayExpr() used palloc toallocate the result array, whereas every other array-creating functionhas used palloc0 since18c0b4e. This mostly works, but unused bitspast the end of the nulls bitmap may end up undefined. That causesvalgrind complaints with -DWRITE_READ_PARSE_PLAN_TREES, and couldcause planner misbehavior as cited in18c0b4e. There seems no verygood reason why we should strive to avoid palloc0 in just this one case,so fix it the easy way with s/palloc/palloc0/.While looking at that I noted that we also failed to check for overflowof "nbytes" and "nitems" while summing the sizes of the sub-arrays,potentially allowing a crash due to undersized output allocation.For "nbytes", follow the policy used by other array-munging code ofchecking for overflow after each addition. (As elsewhere, the lastaddition of the array's overhead space doesn't need an extra check,since palloc itself will catch a value between 1Gb and 2Gb.)For "nitems", there's no very good reason to sum the inputs at all,since we can perfectly well use ArrayGetNItems' result instead ofignoring it.Per discussion of this bug, also remove redundant zeroing of thenulls bitmap in array_set_element and array_set_slice.Patch by Alexander Lakhin and myself, per bug #17858 from AlexanderLakhin; thanks also to Richard Guo. These bugs are a dozen years old,so back-patch to all supported branches.Discussion:https://postgr.es/m/17858-8fd287fd3663d051@postgresql.org
1 parent701ec55 commit7c48734

File tree

2 files changed

+11
-8
lines changed

2 files changed

+11
-8
lines changed

‎src/backend/executor/execExprInterp.c

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2708,7 +2708,7 @@ ExecEvalArrayExpr(ExprState *state, ExprEvalStep *op)
27082708
{
27092709
/* Must be nested array expressions */
27102710
intnbytes=0;
2711-
intnitems=0;
2711+
intnitems;
27122712
intouter_nelems=0;
27132713
intelem_ndims=0;
27142714
int*elem_dims=NULL;
@@ -2803,9 +2803,14 @@ ExecEvalArrayExpr(ExprState *state, ExprEvalStep *op)
28032803
subbitmaps[outer_nelems]=ARR_NULLBITMAP(array);
28042804
subbytes[outer_nelems]=ARR_SIZE(array)-ARR_DATA_OFFSET(array);
28052805
nbytes+=subbytes[outer_nelems];
2806+
/* check for overflow of total request */
2807+
if (!AllocSizeIsValid(nbytes))
2808+
ereport(ERROR,
2809+
(errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
2810+
errmsg("array size exceeds the maximum allowed (%d)",
2811+
(int)MaxAllocSize)));
28062812
subnitems[outer_nelems]=ArrayGetNItems(this_ndims,
28072813
ARR_DIMS(array));
2808-
nitems+=subnitems[outer_nelems];
28092814
havenulls |=ARR_HASNULL(array);
28102815
outer_nelems++;
28112816
}
@@ -2839,7 +2844,7 @@ ExecEvalArrayExpr(ExprState *state, ExprEvalStep *op)
28392844
}
28402845

28412846
/* check for subscript overflow */
2842-
(void)ArrayGetNItems(ndims,dims);
2847+
nitems=ArrayGetNItems(ndims,dims);
28432848
ArrayCheckBounds(ndims,dims,lbs);
28442849

28452850
if (havenulls)
@@ -2853,7 +2858,7 @@ ExecEvalArrayExpr(ExprState *state, ExprEvalStep *op)
28532858
nbytes+=ARR_OVERHEAD_NONULLS(ndims);
28542859
}
28552860

2856-
result= (ArrayType*)palloc(nbytes);
2861+
result= (ArrayType*)palloc0(nbytes);
28572862
SET_VARSIZE(result,nbytes);
28582863
result->ndim=ndims;
28592864
result->dataoffset=dataoffset;

‎src/backend/utils/adt/arrayfuncs.c

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2459,8 +2459,7 @@ array_set_element(Datum arraydatum,
24592459
{
24602460
bits8*newnullbitmap=ARR_NULLBITMAP(newarray);
24612461

2462-
/* Zero the bitmap to take care of marking inserted positions null */
2463-
MemSet(newnullbitmap,0, (newnitems+7) /8);
2462+
/* palloc0 above already marked any inserted positions as nulls */
24642463
/* Fix the inserted value */
24652464
if (addedafter)
24662465
array_set_isnull(newnullbitmap,newnitems-1,isNull);
@@ -3076,8 +3075,7 @@ array_set_slice(Datum arraydatum,
30763075
bits8*newnullbitmap=ARR_NULLBITMAP(newarray);
30773076
bits8*oldnullbitmap=ARR_NULLBITMAP(array);
30783077

3079-
/* Zero the bitmap to handle marking inserted positions null */
3080-
MemSet(newnullbitmap,0, (nitems+7) /8);
3078+
/* palloc0 above already marked any inserted positions as nulls */
30813079
array_bitmap_copy(newnullbitmap,addedbefore,
30823080
oldnullbitmap,0,
30833081
itemsbefore);

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp