Request a Demo
Home   >   mailing lists

[PATCH] pg_surgery: check the page header and line pointers - Mailing list pgsql-hackers

From shihao zhong
Subject [PATCH] pg_surgery: check the page header and line pointers
Date
Msg-id CAGRkXqSC1ZBgk0crX0qHdV5bA8d1refEPS3fmJkk2kKo2qb0Lw@mail.gmail.com
Whole thread
List pgsql-hackers
Tree view
Hi hackers.

heap_force_kill() and heap_force_freeze() index a stack array,
include_this_tid[MaxHeapTuplesPerPage], using PageGetMaxOffsetNumber().

That comes from pd_lower, so a page with pd_lower, pd_upper and
pd_special all 8192 passes PageIsVerified() but has max offset 
(8192 - 24) / 4. The array is then read past its end and the backend crashes.

  ERROR: AddressSanitizer: stack-buffer-overflow READ at heap_surgery.c:256
    [32, 323) 'include_this_tid' <== overflows

Superuser and owner only, so not a security issue.

Thanks,
Shihao
Attachment

pgsql-hackers by date:

Previous
From: shihao zhong
Date:
Subject: Re: logical decoding: skip unnecessary snapshot distribution.
Next
From: shihao zhong
Date:
Subject: Re: aio: Don't silently drop wait_event_info