NotificationsYou must be signed in to change notification settings
Fork5
Star26

Commit780a342

committed

Avoid possibly accessing off the end of memory in examine_attribute().

Since the last couple of columns of pg_type are often NULL,sizeof(FormData_pg_type) can be an overestimate of the actual size of thetuple data part. Therefore memcpy'ing that much out of the catalog cache,as analyze.c was doing, poses a small risk of copying past the end ofmemory and incurring SIGSEGV. No such crash has been identified in thefield, but we've certainly seen the equivalent happen in other code paths,so patch this one all the way back.Per valgrind testing by Noah Misch, though this is not his proposed patch.I chose to use SearchSysCacheCopy1 rather than inventing special-purposeinfrastructure for copying only the minimal part of a pg_type tuple.

1 parent6f94280 commit780a342Copy full SHA for 780a342

File tree

1 file changed

-5

lines changed

src/backend/commands
- analyze.c

1 file changed

-5

lines changed

`‎src/backend/commands/analyze.c`

Lines changed: 4 additions & 5 deletions

Original file line number	Diff line number	Diff line change
`@@ -844,12 +844,11 @@ examine_attribute(Relation onerel, int attnum, Node *index_expr)`
`844`	`844`	`stats->attrtypmod=attr->atttypmod;`
`845`	`845`	`}`
`846`	`846`
`847`		`-typtuple=SearchSysCache1(TYPEOID,ObjectIdGetDatum(stats->attrtypid));`
	`847`	`+typtuple=SearchSysCacheCopy1(TYPEOID,`
	`848`	`+ObjectIdGetDatum(stats->attrtypid));`
`848`	`849`	`if (!HeapTupleIsValid(typtuple))`
`849`	`850`	`elog(ERROR,"cache lookup failed for type %u",stats->attrtypid);`
`850`		`-stats->attrtype= (Form_pg_type)palloc(sizeof(FormData_pg_type));`
`851`		`-memcpy(stats->attrtype,GETSTRUCT(typtuple),sizeof(FormData_pg_type));`
`852`		`-ReleaseSysCache(typtuple);`
	`851`	`+stats->attrtype= (Form_pg_type)GETSTRUCT(typtuple);`
`853`	`852`	`stats->anl_context=anl_context;`
`854`	`853`	`stats->tupattnum=attnum;`
`855`	`854`
`@@ -878,7 +877,7 @@ examine_attribute(Relation onerel, int attnum, Node *index_expr)`
`878`	`877`
`879`	`878`	`if (!ok\|\|stats->compute_stats==NULL\|\|stats->minrows <=0)`
`880`	`879`	`{`
`881`		`-pfree(stats->attrtype);`
	`880`	`+heap_freetuple(typtuple);`
`882`	`881`	`pfree(stats->attr);`
`883`	`882`	`pfree(stats);`
`884`	`883`	`returnNULL;`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commit780a342

File tree

1 file changed

1 file changed

`‎src/backend/commands/analyze.c`

0 commit comments