From f459e4a7e9d542e7c0f0dc8532abd715d7637b97 Mon Sep 17 00:00:00 2001 From: Iliia Khaprov Date: Tue, 20 Oct 2026 20:00:44 +0200 Subject: [PATCH] Prevent overflow of datatotal in DecodeXLogRecord datatotal sums the block data, image and main data lengths of a record and is checked against the bytes left after the headers. It is a uint32, and main_data_len alone can be up to UINT32_MAX, so a record can make the sum wrap to the remaining length and pass the check. The memcpy of the main data then reads far past the record. pg_waldump crashes on such a record. Make datatotal a uint64, so the check sees the real total and the record is rejected as having an invalid length. --- src/backend/access/transam/xlogreader.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/backend/access/transam/xlogreader.c b/src/backend/access/transam/xlogreader.c index e05a831b6e6..7a8a6ef4f1f 100644 --- a/src/backend/access/transam/xlogreader.c +++ b/src/backend/access/transam/xlogreader.c @@ -1820,7 +1820,7 @@ DecodeXLogRecord(XLogReaderState *state, char *ptr; char *out; uint32 remaining; - uint32 datatotal; + uint64 datatotal; RelFileLocator *rlocator = NULL; uint8 block_id; -- 2.53.0