pgsql: Install defenses against overflow in BuildTupleHashTable().

From: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
To: pgsql-committers(at)postgresql(dot)org
Subject: pgsql: Install defenses against overflow in BuildTupleHashTable().
Date: 2011-05-23 16:53:31
Message-ID: E1QOYNn-0002UI-Vj@gemulon.postgresql.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-committers

Install defenses against overflow in BuildTupleHashTable().

The planner can sometimes compute very large values for numGroups, and in
cases where we have no alternative to building a hashtable, such a value
will get fed directly to BuildTupleHashTable as its nbuckets parameter.
There were two ways in which that could go bad. First, BuildTupleHashTable
declared the parameter as "int" but most callers were passing "long"s,
so on 64-bit machines undetected overflow could occur leading to a bogus
negative value. The obvious fix for that is to change the parameter to
"long", which is what I've done in HEAD. In the back branches that seems a
bit risky, though, since third-party code might be calling this function.
So for them, just put in a kluge to treat negative inputs as INT_MAX.
Second, hash_create can go nuts with extremely large requested table sizes
(notably, my_log2 becomes an infinite loop for inputs larger than
LONG_MAX/2). What seems most appropriate to avoid that is to bound the
initial table size request to work_mem.

This fixes bug #6035 reported by Daniel Schreiber. Although the reported
case only occurs back to 8.4 since it involves WITH RECURSIVE, I think
it's a good idea to install the defenses in all supported branches.

Branch
------
REL8_2_STABLE

Details
-------
http://git.postgresql.org/pg/commitdiff/ea393e4973b0ca1db1c1bab9323e072dc5261477

Modified Files
--------------
src/backend/executor/execGrouping.c | 16 +++++++++++++++-
1 files changed, 15 insertions(+), 1 deletions(-)

Browse pgsql-committers by date

  From Date Subject
Next Message Tom Lane 2011-05-23 16:53:32 pgsql: Install defenses against overflow in BuildTupleHashTable().
Previous Message Heikki Linnakangas 2011-05-23 12:01:54 Re: pgsql: Pull up isReset flag from AllocSetContext to MemoryContext struc