From 0c5516a0df97e1e707ea5e9e08712e29ce4ee047 Mon Sep 17 00:00:00 2001 From: Robert Haas Date: Wed, 15 Jul 2026 13:04:32 -0400 Subject: [PATCH] Add additional sanity checks when reading a blkreftable. Code elsewhere in the system assumes that fork numbers and chunk sizes are within bounds, so the code that reads those quantities from disk should validate that they are. Without these additional checks, a corrupted file can cause us to index off the end of fork number or chunk entry arrays, potentially resulting in a crash. Reported-by: oxsignal (chunk sizes) Reported-by: Robert Haas (fork numbers) Reviewed-by: Daniel Gustafsson Discussion: http://postgr.es/m/CA+TgmoYP8RKoBGosS7C6Fdr-GNCfyz_W1zmK=Tx1Fe0ZvzGh0g@mail.gmail.com Backpatch-through: 17 --- src/common/blkreftable.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/src/common/blkreftable.c b/src/common/blkreftable.c index c16ef736f00..3ef5aeae2b0 100644 --- a/src/common/blkreftable.c +++ b/src/common/blkreftable.c @@ -657,6 +657,15 @@ BlockRefTableReaderNextRelation(BlockRefTableReader *reader, return false; } + /* Sanity-check the fork number. */ + if (sentry.forknum < 0 || sentry.forknum > MAX_FORKNUM) + { + reader->error_callback(reader->error_callback_arg, + "file \"%s\" has invalid fork number %d", + reader->error_filename, sentry.forknum); + return false; + } + /* * Sanity-check the nchunks value. In the backend, palloc_array would * enforce this anyway (with a more generic error message); but in @@ -678,6 +687,19 @@ BlockRefTableReaderNextRelation(BlockRefTableReader *reader, BlockRefTableRead(reader, reader->chunk_size, sentry.nchunks * sizeof(uint16)); + /* Sanity-check the chunk sizes. */ + for (unsigned i = 0; i < sentry.nchunks; ++i) + { + if (reader->chunk_size[i] > MAX_ENTRIES_PER_CHUNK) + { + reader->error_callback(reader->error_callback_arg, + "file \"%s\" chunk %u has invalid size %u", + reader->error_filename, i, + (unsigned) reader->chunk_size[i]); + return false; + } + } + /* Set up for chunk scan. */ reader->total_chunks = sentry.nchunks; reader->consumed_chunks = 0;