Thread

1. BUG #18910: DEREF_OF_NULL.RET Pointer, returned from function 'palloc0' at simplehash.h:1080, may be NULL

   PG Bug reporting form <noreply@postgresql.org> — 2025-05-05T08:00:12Z

   The following bug has been logged on the website:
   
   Bug reference:      18910
   Logged by:          Eugeny Goryachev
   Email address:      gorcom2012@gmail.com
   PostgreSQL version: 17.4
   Operating system:   Ubuntu
   Description:        
   
   DEREF_OF_NULL.RET - Pointer returned from function 'palloc0' at
   simplehash.h:1080 may be NULL and is dereferenced at simplehash.h:1105.
   Issue Description:
   In the file /src/include/lib/simplehash.h, within the SH_STAT() function,
   there is a call to palloc0() that may return NULL:
   uint32 *collisions = (uint32 *) palloc0(tb->size * sizeof(uint32));
   Subsequently, the pointer is dereferenced:
   collisions[optimal]++;
   If collisions == NULL, this would cause a segmentation fault.
       Server-side: No issue exists since the server version of palloc never
   returns NULL (throws an error instead).
       Client utilities: simplehash is used in tools like pg_dump,
   pg_verifybackup, and pg_rewind, which use the frontend version of palloc
   (from libpgcommon). The frontend variant can return NULL on memory
   allocation failure.
   Solution:
   A NULL check should be added when the FRONTEND macro is defined.
   diff --git a/src/include/lib/simplehash.h b/src/include/lib/simplehash.h
   index 3e1b1f94616..c4a1419a202 100644
   --- a/src/include/lib/simplehash.h
   +++ b/src/include/lib/simplehash.h
   @@ -1078,6 +1078,10 @@ SH_STAT(SH_TYPE * tb)
           uint32          i;
           uint32     *collisions = (uint32 *) palloc0(tb->size *
   sizeof(uint32));
   +#ifdef FRONTEND
   +       if (unlikely(collisions == NULL))
   +       pg_fatal("out of memory");
   +#endif
           uint32          total_collisions = 0;
           uint32          max_collisions = 0;
           double          avg_collisions;
   
   

2. Re: BUG #18910: DEREF_OF_NULL.RET Pointer, returned from function 'palloc0' at simplehash.h:1080, may be NULL

   Tom Lane <tgl@sss.pgh.pa.us> — 2025-05-05T14:43:07Z

   PG Bug reporting form <noreply@postgresql.org> writes:
   > In the file /src/include/lib/simplehash.h, within the SH_STAT() function,
   > there is a call to palloc0() that may return NULL:
   > uint32 *collisions = (uint32 *) palloc0(tb->size * sizeof(uint32));
   
   palloc and its variants do not return NULL, unless you specify
   MCXT_ALLOC_NO_OOM, which this call does not.
   
   			regards, tom lane