Re: glibc qsort() vulnerability

From: Хамидуллин Рустам <r(dot)khamidullin(at)postgrespro(dot)ru>
To: "Mats Kindahl" <mats(at)timescale(dot)com>
Cc: "Nathan Bossart" <nathandbossart(at)gmail(dot)com>, "Andres Freund" <andres(at)anarazel(dot)de>, "Tom Lane" <tgl(at)sss(dot)pgh(dot)pa(dot)us>, "Thomas Munro" <thomas(dot)munro(at)gmail(dot)com>, "Heikki Linnakangas" <hlinnaka(at)iki(dot)fi>, pgsql-hackers(at)lists(dot)postgresql(dot)org
Subject: Re: glibc qsort() vulnerability
Date: 2026-07-24 15:12:03
Message-ID: 5c5a7984-b149-b505-7ad9-2a7766c65b55@postgrespro.ru
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-hackers


Hi! 
I think there's a bug here: 

diff --git a/src/backend/postmaster/autovacuum.c b/src/backend/postmaster/autovacuum.c 
index 37998f7387..2ab344c1f8 100644 
--- a/src/backend/postmaster/autovacuum.c 
+++ b/src/backend/postmaster/autovacuum.c 
@@ -78,6 +78,7 @@ 
 #include "catalog/pg_database.h" 
 #include "commands/dbcommands.h" 
 #include "commands/vacuum.h" 
+#include "common/int.h" 
 #include "lib/ilist.h" 
 #include "libpq/pqsignal.h" 
 #include "miscadmin.h" 
@@ -1120,10 +1121,8 @@ rebuild_database_list(Oid newdb) 
 static int 
 db_comparator(const void *a, const void *b) 
 { 
-    if (((const avl_dbase *) a)->adl_score == ((const avl_dbase *) b)->adl_score) 
-        return 0; 
-    else 
-        return (((const avl_dbase *) a)->adl_score < ((const avl_dbase *) b)->adl_score) ? 1 : -1; 
+    return pg_cmp_s32(((const avl_dbase *) a)->adl_score, 
+                      ((const avl_dbase *) b)->adl_score); 
 } 

It breaks the database vacuuming order. The order should clearly be different here. 
This bug was introduced in PostgreSQL 17. I have attached а fix. 

Best regards, 
Rustam Khamidullin, Postgres Professional

Attachment Content-Type Size
0001-Fix-reversed-sort-order-in-autovacuum.patch text/x-patch 1.9 KB

In response to

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Stepan Neretin 2026-07-24 15:24:36 Re: amcheck: detect duplicate PostingItem keys in GIN posting trees
Previous Message Ilia Evdokimov 2026-07-24 15:03:11 Re: Extended statistics improvement: multi-column MCV missing values