pgsql: Fix SHMEM_ATTACH_UNKNOWN_SIZE when the shmem area doesn't exist

From: Heikki Linnakangas <heikki(dot)linnakangas(at)iki(dot)fi>
To: pgsql-committers(at)lists(dot)postgresql(dot)org
Subject: pgsql: Fix SHMEM_ATTACH_UNKNOWN_SIZE when the shmem area doesn't exist
Date: 2026-09-18 09:15:25
Message-ID: E1x7Ugn-00000000F9C-3C2z@gemulon.postgresql.org
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-committers

Fix SHMEM_ATTACH_UNKNOWN_SIZE when the shmem area doesn't exist

SHMEM_ATTACH_UNKNOWN_SIZE can be passed as argument to
ShmemRequestStruct() when the caller wants to attach to an existing
shared memory structure whose size it doesn't know. If the shared
memory structure doesn't exist, the request should fail, but instead,
ProcessShmemRequestsAfterStartup() tried to create the structure with
size = -1. That led to integer overflow in ShmemAllocRaw() and memory
corruption.

Fix by rejecting requests with SHMEM_ATTACH_UNKNOWN_SIZE when the
structure doesn't exist. Also add an integer overflow check in
ShmemAllocRaw(), to protect from this kind of confusion or simply too
large requests. Also document SHMEM_ATTACH_UNKNOWN_SIZE.

Author: Ashutosh Bapat <ashutosh(dot)bapat(dot)oss(at)gmail(dot)com>
Discussion: https://www.postgresql.org/message-id/CAExHW5u_fTsOAS85kG981Vu6eR1GV-344rup6zYew7xMjEDREw@mail.gmail.com
Backpatch-through: 19

Branch
------
REL_19_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/b118f8c841d53f24d9fd159df83a386ea3ce204d

Modified Files
--------------
doc/src/sgml/xfunc.sgml | 10 ++++++++++
src/backend/storage/ipc/shmem.c | 22 ++++++++++++++++++++--
.../modules/test_shmem/t/001_late_shmem_alloc.pl | 17 +++++++++++++++++
src/test/modules/test_shmem/test_shmem.c | 11 +++++++----
4 files changed, 54 insertions(+), 6 deletions(-)

Browse pgsql-committers by date

  From Date Subject
Next Message Álvaro Herrera 2026-09-18 11:41:44 pgsql: Tighten definition of ON CONFLICT arbiter index equivalence
Previous Message Etsuro Fujita 2026-09-18 08:47:34 pgsql: postgres_fdw: Fix oversights in fetch_attstats().