database/postgres
database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-05-05 09:19:17 +03:00
Code

Fix incorrect sentinel byte logic in GenerationRealloc()

Browse Source 
This only affects MEMORY_CONTEXT_CHECKING builds.

This fixes an off-by-one issue in GenerationRealloc() where the
fast-path code which tries to reuse the existing allocation if the
existing chunk is >= the new requested size.  The code there thought it
was always ok to use the existing chunk, but when oldsize == size there
isn't enough space to store the sentinel byte.  If both sizes matched
exactly set_sentinel() would overwrite the first byte beyond the chunk
and then subsequent GenerationRealloc() calls could then fail the
Assert(chunk->requested_size < oldsize) check which is trying to ensure
the chunk is large enough to store the sentinel.

The same issue does not exist in aset.c as the sentinel checking code
only adds a sentinel byte if there's enough space in the chunk.

Reported-by: Alexander Lakhin <exclusion@gmail.com>
Discussion: https://postgr.es/m/49275921-7b39-41af-5eb8-97b50ce3312e@gmail.com
Backpatch-through: 16, where the problem was introduced by 0e480385e
This commit is contained in:
David Rowley 2024-07-06 13:59:34 +12:00
parent 2a5ef09830
commit 97651b0139
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/backend/utils/mmgr/generation.c
View File

@ -846,8 +846,8 @@ GenerationRealloc(void *pointer, Size size, int flags)
#endif #endif
/* /*
* Maybe the allocated area already is >= the new size. (In particular, * Maybe the allocated area already big enough. (In particular, we always
* we always fall out here if the requested size is a decrease.) * fall out here if the requested size is a decrease.)
* *
* This memory context does not use power-of-2 chunk sizing and instead * This memory context does not use power-of-2 chunk sizing and instead
* carves the chunks to be as small as possible, so most repalloc() calls * carves the chunks to be as small as possible, so most repalloc() calls
@ -855,7 +855,12 @@ GenerationRealloc(void *pointer, Size size, int flags)
* *
* XXX Perhaps we should annotate this condition with unlikely()? * XXX Perhaps we should annotate this condition with unlikely()?
*/ */
#ifdef MEMORY_CONTEXT_CHECKING
/* With MEMORY_CONTEXT_CHECKING, we need an extra byte for the sentinel */
if (oldsize > size)
#else
if (oldsize >= size) if (oldsize >= size)
#endif
{ {
#ifdef MEMORY_CONTEXT_CHECKING #ifdef MEMORY_CONTEXT_CHECKING
Size oldrequest = chunk->requested_size; Size oldrequest = chunk->requested_size;