From 20db10b9e9f768a4828c43c00ad01d078bade9c9 Mon Sep 17 00:00:00 2001 From: Robert Haas Date: Fri, 26 Jun 2026 13:30:03 -0400 Subject: [PATCH v1] Add additional sanity checks when reading a blkreftable. Code elsewhere in the system assumes that fork numbers and chunk sizes are within bounds, so the code that reads those quantities from disk should validate that they are. Without these additional checks, an intentionally corrupted file -- that is, one where the checksum is valid but the contents are not -- can index off the end of fork number or chunk entry arrays, potentially resulting in a crash. Reported-by: oxsignal (chunk sizes) Reported-by: Robert Haas (fork numbers) --- src/common/blkreftable.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/src/common/blkreftable.c b/src/common/blkreftable.c index 2bb91e39128..4d4ff3b2ce1 100644 --- a/src/common/blkreftable.c +++ b/src/common/blkreftable.c @@ -657,6 +657,15 @@ BlockRefTableReaderNextRelation(BlockRefTableReader *reader, return false; } + /* Sanity-check the fork number. */ + if (sentry.forknum < 0 || sentry.forknum > MAX_FORKNUM) + { + reader->error_callback(reader->error_callback_arg, + "file \"%s\" has invalid fork number %d", + reader->error_filename, sentry.forknum); + return false; + } + /* * Sanity-check the nchunks value. In the backend, palloc_array would * enforce this anyway (with a more generic error message); but in @@ -678,6 +687,18 @@ BlockRefTableReaderNextRelation(BlockRefTableReader *reader, BlockRefTableRead(reader, reader->chunk_size, sentry.nchunks * sizeof(uint16)); + /* Sanity-check the chunk sizes. */ + for (unsigned i = 0; i < sentry.nchunks; ++i) + { + if (reader->chunk_size[i] > MAX_ENTRIES_PER_CHUNK) + { + reader->error_callback(reader->error_callback_arg, + "file \"%s\" has oversized chunk", + reader->error_filename); + return false; + } + } + /* Set up for chunk scan. */ reader->total_chunks = sentry.nchunks; reader->consumed_chunks = 0; -- 2.51.0