From 6789d78d1881ca1a52b3f78e8060b0c2806ec95e Mon Sep 17 00:00:00 2001 From: Robert Haas Date: Wed, 15 Jul 2026 11:30:14 -0400 Subject: [PATCH v2] Add additional sanity checks when reading a blkreftable. Code elsewhere in the system assumes that fork numbers and chunk sizes are within bounds, so the code that reads those quantities from disk should validate that they are. Without these additional checks, an intentionally corrupted file -- that is, one where the checksum is valid but the contents are not -- can index off the end of fork number or chunk entry arrays, potentially resulting in a crash. Reported-by: oxsignal (chunk sizes) Reported-by: Robert Haas (fork numbers) Reviewed-by: Daniel Gustafsson Discussion: http://postgr.es/m/CA+TgmoYP8RKoBGosS7C6Fdr-GNCfyz_W1zmK=Tx1Fe0ZvzGh0g@mail.gmail.com --- src/common/blkreftable.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/src/common/blkreftable.c b/src/common/blkreftable.c index a4c72159f94..63e068a8f18 100644 --- a/src/common/blkreftable.c +++ b/src/common/blkreftable.c @@ -657,6 +657,15 @@ BlockRefTableReaderNextRelation(BlockRefTableReader *reader, return false; } + /* Sanity-check the fork number. */ + if (sentry.forknum < 0 || sentry.forknum > MAX_FORKNUM) + { + reader->error_callback(reader->error_callback_arg, + "file \"%s\" has invalid fork number %d", + reader->error_filename, sentry.forknum); + return false; + } + /* * Sanity-check the nchunks value. In the backend, palloc_array would * enforce this anyway (with a more generic error message); but in @@ -678,6 +687,19 @@ BlockRefTableReaderNextRelation(BlockRefTableReader *reader, BlockRefTableRead(reader, reader->chunk_size, sentry.nchunks * sizeof(uint16)); + /* Sanity-check the chunk sizes. */ + for (unsigned i = 0; i < sentry.nchunks; ++i) + { + if (reader->chunk_size[i] > MAX_ENTRIES_PER_CHUNK) + { + reader->error_callback(reader->error_callback_arg, + "file \"%s\" chunk %u has invalid size %u", + reader->error_filename, i, + (unsigned) reader->chunk_size[i]); + return false; + } + } + /* Set up for chunk scan. */ reader->total_chunks = sentry.nchunks; reader->consumed_chunks = 0; -- 2.50.1 (Apple Git-155)