From: | Peter Geoghegan <pg(at)heroku(dot)com> |
---|---|
To: | Noah Misch <noah(at)leadboat(dot)com> |
Cc: | Kevin Grittner <kgrittn(at)ymail(dot)com>, Andres Freund <andres(at)2ndquadrant(dot)com>, "pgsql-hackers(at)postgresql(dot)org" <pgsql-hackers(at)postgresql(dot)org> |
Subject: | Re: doPickSplit stack buffer overflow in XLogInsert? |
Date: | 2014-03-27 01:45:54 |
Message-ID: | CAM3SWZTrzmgyXLJrVHVbD8bSSY4zNS3xyDwmtmJ3ctc9py7qAg@mail.gmail.com |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
On Wed, Nov 27, 2013 at 9:10 AM, Noah Misch <noah(at)leadboat(dot)com> wrote:
> The threat is that rounding the read size up to the next MAXALIGN would cross
> into an unreadable memory page, resulting in a SIGSEGV. Every palloc chunk
> has MAXALIGN'd size under the hood, so the excess read of "toDelete" cannot
> cause a SIGSEGV. For a stack variable, it depends on the ABI. I'm not aware
> of an ABI where the four bytes past the end of this stack variable could be
> unreadable, which is not to claim I'm well-read on the topic. We should fix
> this in due course on code hygiene grounds, but I would not back-patch it.
Attached patch silences the "Invalid read of size n" complaints of
Valgrind. I agree with your general thoughts around backpatching. Note
that the patch addresses a distinct complaint from Kevin's, as
Valgrind doesn't take issue with the invalid reads past the end of
spgxlogPickSplit variables on the stack.
--
Peter Geoghegan
Attachment | Content-Type | Size |
---|---|---|
spgsplit_invalid_read.patch | text/x-patch | 1.8 KB |
From | Date | Subject | |
---|---|---|---|
Next Message | Etsuro Fujita | 2014-03-27 01:49:51 | Re: inherit support for foreign tables |
Previous Message | Fabrízio de Royes Mello | 2014-03-27 01:25:00 | Re: Patch to add support of "IF NOT EXISTS" to others "CREATE" statements |