Preventing abort() and exit() calls in libpq
Tom Lane <tgl@sss.pgh.pa.us>
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Michael Paquier <michael@paquier.xyz>
Cc: Jacob Champion <pchampion@vmware.com>,
"pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>,
Daniel Gustafsson <daniel@yesql.se>
Date: 2021-06-26T21:29:29Z
Lists: pgsql-hackers
Attachments
- disallow-abort-and-exit-in-libpq-1.patch (text/x-diff) patch
[ starting a new thread so as not to confuse the cfbot ] I wrote: > Michael Paquier <michael@paquier.xyz> writes: >> Good point. That's worse than just pfree() which is just a plain call >> to free() in the frontend. We could have more policies here, but my >> take is that we'd better move fe_memutils.o to OBJS_FRONTEND in >> src/common/Makefile so as shared libraries don't use those routines in >> the long term. > Ugh. Not only is that bad, but your proposed fix doesn't fix it. > At least in psql, and probably in most/all of our other clients, > removing fe_memutils.o from libpq's link just causes it to start > relying on the copy in the psql executable :-(. So I agree that > some sort of mechanical enforcement would be a really good thing, > but I'm not sure what it would look like. After some thought I propose that what we really want is to prevent any calls of abort() or exit() from inside libpq. Attached is a draft patch to do that. This can't be committed as-is, because we still have some abort() calls in there in HEAD, but if we could get that cleaned up it'd work. Alternatively we could just disallow exit(), which'd be enough to catch the problematic src/common files. This relies on "nm" being able to work on shlibs, which it's not required to by POSIX. However, it seems to behave as desired even on my oldest dinosaurs. In any case, if "nm" doesn't work then we'll just not detect such problems on that platform, which should be OK as long as the test does work on common platforms. Other than that point I think it's relying only on POSIX-spec features. I'll stick this into the CF list to see if the cfbot agrees that it finds the abort() problems... regards, tom lane
Commits
-
Further restrict the scope of no-exit()-in-libpq test.
- 792259591c0f 15.0 landed
-
Improve build-time check that libpq doesn't call exit().
- 2f7bae2f924d 15.0 landed
-
Fix portability fallout from commit dc227eb82.
- e45b0dfa1f10 15.0 landed
-
Add a build-time check that libpq doesn't call exit() or abort().
- dc227eb82ea8 15.0 landed