Protect against possible memory corruption (src/backend/access/nbtree/nbtxlog.c)

Ranier Vilela <ranier.vf@gmail.com>

From: Ranier Vilela <ranier.vf@gmail.com>

To: Pg Hackers <pgsql-hackers@postgresql.org>

Date: 2021-07-11T19:51:04Z

Lists: pgsql-hackers

Attachments

0001-_bt_restore_page-have-issues-can-lead-a-memory-corru.patch (application/octet-stream) patch 0001

Hi,

While analyzing a possible use of an uninitialized variable, I checked that
*_bt_restore_page* can lead to memory corruption,
by not checking the maximum limit of array items which is
MaxIndexTuplesPerPage.

It can also generate a dangling pointer by incrementing it beyond the
limits it can point to.

While there, I promoted a reduction of scope and adaptation of the type of
the *len* parameter to match XLogRecGetBlockData function.

pass regress check at Windows and check-world at Linux.

regards,
Ranier Vilela

Commits

Remove dead assignment to local variable.
- 00e77ef76c5c 9.6.23 landed
- 96c0890d4bb1 10.18 landed
- f4b3ab537fe2 11.13 landed
- 4df5f6c26b2d 12.8 landed
- 2c27cc26592a 13.4 landed
- 233280803cb6 14.0 landed
- 4c64b51dc51f 15.0 landed
Retain original physical order of tuples in redo of b-tree splits.
- 7e30c186da8e 9.4.0 cited