Re: Avoid a possible out-of-bounds access (src/backend/optimizer/util/relnode.c) - Mailing list pgsql-hackers

Hi,

On Sat, Sep 23, 2023 at 9:59 PM Ranier Vilela <ranier.vf@gmail.com> wrote:
> Per Coverity.
> CID 1518088 (#2 of 2): Improper use of negative value (NEGATIVE_RETURNS)
>
> The function bms_singleton_member can returns a negative number.
>
> /*
> * Get a child rel for rel2 with the relids.  See above comments.
> */
> if (rel2_is_simple)
> {
> int varno = bms_singleton_member(child_relids2);
>
> child_rel2 = find_base_rel(root, varno);
> }
>
> It turns out that in the get_matching_part_pairs function (joinrels.c), the return of bms_singleton_member is passed
tothe find_base_rel function, which cannot receive a negative value. 
>
> find_base_rel is protected by an Assertion, which effectively indicates that the error does not occur in tests and in
DEBUGmode. 
>
> But this does not change the fact that bms_singleton_member can return a negative value, which may occur on some
productionservers. 
>
> Fix by changing the Assertion into a real test, to protect the simple_rel_array array.

Thanks for the report and patch!  I will review the patch.

Best regards,
Etsuro Fujita