Re: doPickSplit stack buffer overflow in XLogInsert? - Mailing list pgsql-hackers

From Andres Freund
Subject Re: doPickSplit stack buffer overflow in XLogInsert?
Date
Msg-id 20140505200238.GI17909@awork2.anarazel.de
Whole thread Raw
In response to Re: doPickSplit stack buffer overflow in XLogInsert?  (Peter Geoghegan <pg@heroku.com>)
List pgsql-hackers
Hi,

We really should fix this one of these days.

On 2014-03-26 18:45:54 -0700, Peter Geoghegan wrote:
> Attached patch silences the "Invalid read of size n" complaints of
> Valgrind. I agree with your general thoughts around backpatching. Note
> that the patch addresses a distinct complaint from Kevin's, as
> Valgrind doesn't take issue with the invalid reads past the end of
> spgxlogPickSplit variables on the stack.

I don't think that's entirely sufficient. The local spgxlogPickSplit
xlrec;/spgxlogMoveLeafs xlrec; variables are also inserted while
MAXLIGNing their size. That's slightly harder to fix :(. I don't have a
better idea than also allocating them dynamically :(

Greetings,

Andres Freund

-- Andres Freund                       http://www.2ndQuadrant.com/PostgreSQL Development, 24x7 Support, Training &
Services



pgsql-hackers by date:

Previous
From: Tom Lane
Date:
Subject: Re: Recursive ReceiveSharedInvalidMessages not safe
Next
From: Andres Freund
Date:
Subject: Re: Recursive ReceiveSharedInvalidMessages not safe