NotificationsYou must be signed in to change notification settings
Fork28
Star151

Commit4c20ee5

committed

Fix access-off-end-of-array in clog.c.

Sloppy loop coding in set_status_by_pages() resulted in fetching one arrayelement more than it should from the subxids[] array. The odds of thisresulting in SIGSEGV are pretty small, but we've certainly seen that happenwith similar mistakes elsewhere. While at it, we can get rid of an extraTransactionIdToPage() calculation per loop.Per report from David Binderman. Back-patch to all supported branches,since this code is quite old.Discussion:https://postgr.es/m/HE1PR0802MB2331CBA919CBFFF0C465EB429C710@HE1PR0802MB2331.eurprd08.prod.outlook.com

1 parent2257673 commit4c20ee5Copy full SHA for 4c20ee5

File tree

1 file changed

-3

lines changed

src/backend/access/transam
- clog.c

1 file changed

-3

lines changed

`‎src/backend/access/transam/clog.c`

Lines changed: 9 additions & 3 deletions

Original file line number	Diff line number	Diff line change
`@@ -227,21 +227,27 @@ set_status_by_pages(int nsubxids, TransactionId *subxids,`
`227`	`227`	`intoffset=0;`
`228`	`228`	`inti=0;`
`229`	`229`
	`230`	`+Assert(nsubxids>0);/* else the pageno fetch above is unsafe */`
	`231`	`+`
`230`	`232`	`while (i<nsubxids)`
`231`	`233`	`{`
`232`	`234`	`intnum_on_page=0;`
	`235`	`+intnextpageno;`
`233`	`236`
`234`		`-while (TransactionIdToPage(subxids[i])==pageno&&i<nsubxids)`
	`237`	`+do`
`235`	`238`	`{`
	`239`	`+nextpageno=TransactionIdToPage(subxids[i]);`
	`240`	`+if (nextpageno!=pageno)`
	`241`	`+break;`
`236`	`242`	`num_on_page++;`
`237`	`243`	`i++;`
`238`		`-}`
	`244`	`+}while (i<nsubxids);`
`239`	`245`
`240`	`246`	`TransactionIdSetPageStatus(InvalidTransactionId,`
`241`	`247`	`num_on_page,subxids+offset,`
`242`	`248`	`status,lsn,pageno);`
`243`	`249`	`offset=i;`
`244`		`-pageno=TransactionIdToPage(subxids[offset]);`
	`250`	`+pageno=nextpageno;`
`245`	`251`	`}`
`246`	`252`	`}`
`247`	`253`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commit4c20ee5

File tree

1 file changed

1 file changed

`‎src/backend/access/transam/clog.c`

0 commit comments