BUG #17277: write past chunk when calling normalize() on an empty string

From: PG Bug reporting form <noreply(at)postgresql(dot)org>
To: pgsql-bugs(at)lists(dot)postgresql(dot)org
Cc: postgresql(at)zr40(dot)nl
Subject: BUG #17277: write past chunk when calling normalize() on an empty string
Date: 2021-11-09 21:55:08
Message-ID: 17277-0c527a373794e802@postgresql.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-bugs

The following bug has been logged on the website:

Bug reference: 17277
Logged by: Matthijs van der Vleuten
Email address: postgresql(at)zr40(dot)nl
PostgreSQL version: 14.0
Operating system: Debian sid
Description:

When calling normalize(''), that is, on an empty string, a warning is
raised: "problem in alloc set ExprContext: detected write past chunk end".

I believe this is due to an error in unicode_norm.c. In unicode_normalize(),
when recompose is true (that is, when using NFC or NFKC normalization) the
loop on line 498 will iterate once before checking count < decomp_size. When
the input is an empty string, this would cause a write outside of the memory
allocated for recomp_chars.

Reproduction:
zr40(at)[local]:5432 ~=# select version();
version

──────────────────────────────────────────────────────────────────────────────────────────────────────────────────
PostgreSQL 14.0 (Debian 14.0-1.pgdg+1) on x86_64-pc-linux-gnu, compiled by
gcc (Debian 10.3.0-11) 10.3.0, 64-bit
(1 row)
zr40(at)[local]:5432 ~=# select normalize('');
WARNING: problem in alloc set ExprContext: detected write past chunk end in
block 0x55793d119620, chunk 0x55793d1196a8
WARNING: problem in alloc set ExprContext: detected write past chunk end in
block 0x55793d119620, chunk 0x55793d1196a8
normalize
───────────

(1 row)

Responses

Browse pgsql-bugs by date

  From Date Subject
Next Message Thomas Munro 2021-11-09 21:55:13 Re: CREATE INDEX CONCURRENTLY does not index prepared xact's data
Previous Message Peter Geoghegan 2021-11-09 17:51:45 Re: BUG #17255: Server crashes in index_delete_sort_cmp() due to race condition with vacuum