Re: Invalid memory access in pg_stat_get_subscription

Tom Lane <tgl@sss.pgh.pa.us>

From: Tom Lane <tgl@sss.pgh.pa.us>

To: Kuntal Ghosh <kuntalghosh.2007@gmail.com>

Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>

Date: 2022-06-07T19:14:43Z

Lists: pgsql-hackers

Commits

Same data as JSON: GET /api/v1/messages/:b64id/commits the thread's linked commits as JSON, with link sources. API reference →

Fix off-by-one loop termination condition in pg_stat_get_subscription().
- fb646cbd5a9e 10.22 landed
- d628ce048d47 11.17 landed
- bf4717b09107 15.0 landed
- a36196972b77 13.8 landed
- 5c3b5f7db6ce 14.4 landed
- 435251b859ab 12.12 landed

Kuntal Ghosh <kuntalghosh.2007@gmail.com> writes:
> While exploring some code in logical replication worker
> implementation, I noticed that we're accessing an invalid memory while
> traversing LogicalRepCtx->workers[i].
> For the above structure, we're allocating
> max_logical_replication_workers times LogicalRepWorker amount of
> memory in ApplyLauncherShmemSize. But, in the for loop, we're
> accessing the max_logical_replication_workers + 1 location which is
> resulting in random crashes.

I concur that that's a bug, but eyeing the code, it seems like an
actual crash would be improbable.  Have you seen one?  Can you
reproduce it?

> Please find the patch that fixes the issue. I'm not sure whether we
> should add a regression test for the same.

How would you make a stable regression test for that?

			regards, tom lane