Re: BUG #14615: ReplicationOriginShmemInit Memory access cross-border

On 2017-04-10 15:38:56 +0900, Michael Paquier wrote:
> diff --git a/src/backend/replication/logical/origin.c b/src/backend/replication/logical/origin.c
> index 5eaf863e02..0aa468789c 100644
> --- a/src/backend/replication/logical/origin.c
> +++ b/src/backend/replication/logical/origin.c
> @@ -473,7 +473,8 @@ ReplicationOriginShmemInit(void)
>
> replication_states_ctl->tranche_id = LWTRANCHE_REPLICATION_ORIGIN;
>
> - MemSet(replication_states, 0, ReplicationOriginShmemSize());
> + MemSet(replication_states, 0,
> + mul_size(max_replication_slots, sizeof(ReplicationState)));

What's the benefit of using mul_size here? That's usually only
beneficial in the original size computation - during use/initialization
an actual error should be impossible.

To me the right fix seems to be to just do:
- replication_states_ctl->tranche_id = LWTRANCHE_REPLICATION_ORIGIN;
-
- MemSet(replication_states, 0, ReplicationOriginShmemSize());
+ MemSet(replication_states_ctl, 0, ReplicationOriginShmemSize());
+
+ replication_states_ctl->tranche_id = LWTRANCHE_REPLICATION_ORIGIN;

No?

Greetings,

Andres Freund