e60ee52841
The sequencesync worker asks the publisher about a batch of sequences, tagging each one with its position in the worker's own list, and the publisher returns that position alongside the sequence's data. The received position is used to subscript the list using list_nth(), which bounds-checks only on assert builds, so it was possible that an index we never sent made the worker read a pointer from past the end of the list and then store the remote last_value through it. Check the position against the list before using it. No sane publisher can trigger this, but we should not let a remote server steer a memory access. An in-range position from another batch still gets through and would attach one sequence's data to another, but that's a wrong value rather than a corrupt process. Also, receive the index as int4 rather than int8. Previously, an out-of-range int8 value was silently truncated to its lower 32 bits by DatumGetInt32(), which could turn it into a valid index and defeat the check. Backpatch to v19, where sequence synchronization was introduced. Reported-by: Anthropic OSS program Reviewed-by: Amit Kapila <amit.kapila16@gmail.com> Reviewed-by: Chao Li <li.evan.chao@gmail.com> Discussion: https://postgr.es/m/CAD21AoBWDMuMmnevZaZ1xSOi75eUx8X7LbVQzmUZudk6F8Bdgg@mail.gmail.com Backpatch-through: 19
PostgreSQL Database Management System
This directory contains the source code distribution of the PostgreSQL database management system.
PostgreSQL is an advanced object-relational database management system that supports an extended subset of the SQL standard, including transactions, foreign keys, subqueries, triggers, user-defined types and functions. This distribution also contains C language bindings.
Copyright and license information can be found in the file COPYRIGHT.
General documentation about this version of PostgreSQL can be found at https://www.postgresql.org/docs/19/. In particular, information about building PostgreSQL from the source code can be found at https://www.postgresql.org/docs/19/installation.html.
The latest version of this software, and related software, may be obtained at https://www.postgresql.org/download/. For more information look at our web site located at https://www.postgresql.org/.