Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitf1821b5

Browse files
committed
Fix WaitEventSetWait() buffer overrun.
The WAIT_USE_EPOLL and WAIT_USE_KQUEUE implementations ofWaitEventSetWaitBlock() confused the size of their internal buffer withthe size of the caller's output buffer, and could ask the kernel for toomany events. In fact the set of events retrieved from the kernel needsto be able to fit in both buffers, so take the smaller of the two.The WAIT_USE_POLL and WAIT_USE WIN32 implementations didn't have thisconfusion.This probably didn't come up before because we always used the samenumber in both places, but commit7389aad calculates a dynamic size atconstruction time, while using MAXLISTEN for its output event buffer onthe stack. That seems like a reasonable thing to want to do, soconsider this to be a pre-existing bug worth fixing.As discovered by valgrind on skink.Back-patch to all supported releases for epoll, and to release 13 forthe kqueue part, which copied the incorrect epoll code.Reviewed-by: Andres Freund <andres@anarazel.de>Discussion:https://postgr.es/m/901504.1673504836%40sss.pgh.pa.us
1 parent3161ae8 commitf1821b5

File tree

1 file changed

+3
-2
lines changed

1 file changed

+3
-2
lines changed

‎src/backend/storage/ipc/latch.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1525,7 +1525,7 @@ WaitEventSetWaitBlock(WaitEventSet *set, int cur_timeout,
15251525

15261526
/* Sleep */
15271527
rc=epoll_wait(set->epoll_fd,set->epoll_ret_events,
1528-
nevents,cur_timeout);
1528+
Min(nevents,set->nevents_space),cur_timeout);
15291529

15301530
/* Check return code */
15311531
if (rc<0)
@@ -1685,7 +1685,8 @@ WaitEventSetWaitBlock(WaitEventSet *set, int cur_timeout,
16851685

16861686
/* Sleep */
16871687
rc=kevent(set->kqueue_fd,NULL,0,
1688-
set->kqueue_ret_events,nevents,
1688+
set->kqueue_ret_events,
1689+
Min(nevents,set->nevents_space),
16891690
timeout_p);
16901691

16911692
/* Check return code */

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp