mirror of
https://github.com/postgres/postgres.git
synced 2026-10-23 13:29:09 +03:00
92e20d4a43
hstore has been relying on a set of int/int32 to count the total length of all the keys and values constructed, relying on the maximum values of the arguments rather than proper bound checks. As proved in the reported thread, these counters could overflow and wrap, leading to incorrect allocations. This commit replaces the int/int32 values with a set of Size values, with add_size() and mul_size() in charge of checking for overflows when constructing hstore values before doing any allocation. The changes that matter in terms of the report are mostly in hstore_io.c. hstore_compat.c is adjusted for consistency, to keep the allocation maths uniform across the module. This is an old bug. A backpatch should perhaps be done but I cannot get excited about a change like that in stable branches. Reported-by: Man Zeng <zengman@halodbtech.com> Author: Tender Wang <tndrwang@gmail.com> Author: Michael Paquier <michael@paquier.xyz> Discussion: https://postgr.es/m/CAHewXNmfD6-9MDxgpRfTzjVj0mhBw3JMoNOHeTiPOjZGhNzd=g@mail.gmail.com