database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2026-10-23 13:29:09 +03:00
Code Activity

Add additional sanity checks when reading a blkreftable.

Browse Source 
Code elsewhere in the system assumes that fork numbers and chunk sizes
are within bounds, so the code that reads those quantities from disk
should validate that they are. Without these additional checks, a
corrupted file can cause us to index off the end of fork number or chunk
entry arrays, potentially resulting in a crash.

Reported-by: oxsignal <awo@kakao.com> (chunk sizes)
Reported-by: Robert Haas <rhaas@postgresql.org> (fork numbers)
Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
Discussion: http://postgr.es/m/CA+TgmoYP8RKoBGosS7C6Fdr-GNCfyz_W1zmK=Tx1Fe0ZvzGh0g@mail.gmail.com
Backpatch-through: 17
This commit is contained in:
Robert Haas
2026-07-15 13:04:32 -04:00
parent ae8c4bd558
commit bcc428a23a
1 changed files with 22 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
src/common/blkreftable.c
View File

@@ -657,6 +657,15 @@ BlockRefTableReaderNextRelation(BlockRefTableReader *reader,
return false;
}
/* Sanity-check the fork number. */
if (sentry.forknum < 0 || sentry.forknum > MAX_FORKNUM)
{
reader->error_callback(reader->error_callback_arg,
"file \"%s\" has invalid fork number %d",
reader->error_filename, sentry.forknum);
return false;
}
/*
* Sanity-check the nchunks value. In the backend, palloc_array would
* enforce this anyway (with a more generic error message); but in
@@ -678,6 +687,19 @@ BlockRefTableReaderNextRelation(BlockRefTableReader *reader,
BlockRefTableRead(reader, reader->chunk_size,
sentry.nchunks * sizeof(uint16));
/* Sanity-check the chunk sizes. */
for (unsigned i = 0; i < sentry.nchunks; ++i)
{
if (reader->chunk_size[i] > MAX_ENTRIES_PER_CHUNK)
{
reader->error_callback(reader->error_callback_arg,
"file \"%s\" chunk %u has invalid size %u",
reader->error_filename, i,
(unsigned) reader->chunk_size[i]);
return false;
}
}
/* Set up for chunk scan. */
reader->total_chunks = sentry.nchunks;
reader->consumed_chunks = 0;