Re: pg_control is missing a field for LOBLKSIZE

On Wed, Jun 4, 2014 at 06:57:31PM -0400, Tom Lane wrote:
> Stephen Frost <sfrost(at)snowman(dot)net> writes:
> > * Tom Lane (tgl(at)sss(dot)pgh(dot)pa(dot)us) wrote:
> >> There are at least two places in inv_api.c where we have
> >> "Assert(pagelen <= LOBLKSIZE)" that is protecting a subsequent memcpy
> >> into a local variable of size LOBLKSIZE, so that the only thing standing
> >> between us and a stack-smash security issue that's trivially exploitable
> >> in production builds is that on-disk data conforms to our expectation
> >> about LOBLKSIZE. I think it's definitely worth promoting these checks
> >> to regular runtime-if-test-and-elog.
>
> > Agreed. Promoting that to a run-time check seems well worth it to me.
>
> Here's a draft patch for this. Barring objections I'll commit the whole
> thing to HEAD, and the inv_api.c changes to the back branches as well.

Uh, I think pg_upgrade needs to check that they match too.

--
Bruce Momjian <bruce(at)momjian(dot)us> http://momjian.us
EnterpriseDB http://enterprisedb.com

+ Everyone has their own god. +