pgsql: Avoid possibly accessing off the end of memory in examine_attrib

From: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
To: pgsql-committers(at)postgresql(dot)org
Subject: pgsql: Avoid possibly accessing off the end of memory in examine_attrib
Date: 2011-09-06 18:38:37
Message-ID: E1R10Xd-0000Se-Ie@gemulon.postgresql.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-committers

Avoid possibly accessing off the end of memory in examine_attribute().

Since the last couple of columns of pg_type are often NULL,
sizeof(FormData_pg_type) can be an overestimate of the actual size of the
tuple data part. Therefore memcpy'ing that much out of the catalog cache,
as analyze.c was doing, poses a small risk of copying past the end of
memory and incurring SIGSEGV. No such crash has been identified in the
field, but we've certainly seen the equivalent happen in other code paths,
so patch this one all the way back.

Per valgrind testing by Noah Misch, though this is not his proposed patch.
I chose to use SearchSysCacheCopy1 rather than inventing special-purpose
infrastructure for copying only the minimal part of a pg_type tuple.

Branch
------
REL8_3_STABLE

Details
-------
http://git.postgresql.org/pg/commitdiff/3cfb60272ce6dc95ea367446fb20db91ed05476e

Modified Files
--------------
src/backend/commands/analyze.c | 12 +++++-------
1 files changed, 5 insertions(+), 7 deletions(-)

Browse pgsql-committers by date

  From Date Subject
Next Message Tom Lane 2011-09-06 18:53:29 pgsql: Avoid possibly accessing off the end of memory in SJIS2004 conve
Previous Message Bruce Momjian 2011-09-06 17:42:13 pgsql: Document PERFORM limitation when using WITH queries.