[NBTREE] Possible NULL pointer dereference (backend/access/nbtree/nbutils.c)

From: Ranier Vilela <ranier(dot)vf(at)gmail(dot)com>
To: PostgreSQL Hackers <pgsql-hackers(at)lists(dot)postgresql(dot)org>
Subject: [NBTREE] Possible NULL pointer dereference (backend/access/nbtree/nbutils.c)
Date: 2020-09-02 21:39:09
Message-ID: CAEudQApXsNo0pvk_Kt+k8TpFcOtPiiumAnEt3nE1u=ubOf8TjQ@mail.gmail.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

Hi,

Is possible that BTreeTupleSetNAtts, leave everything tidy, so that
BTreeTupleGetHeapTID doesn't fail.
BTreeTupleGetHeapTID can return NULL.

But, as we can see:
1. Line 2085 (nbtutils.c):
if (BTreeTupleGetHeapTID(itup) != NULL && tupnatts != nkeyatts)
2. Line 803 (nbtsearch.c):
if (heapTid == NULL)

Maybe, better make sure, because:
3. Line 2285 (nbtutils.c):
ItemPointerCopy(BTreeTupleGetMaxHeapTID(lastleft), pivotheaptid);
4. Line 2316 (nbtutils.c) :
ItemPointerCopy(BTreeTupleGetHeapTID(firstright), pivotheaptid);

Can dereference NULL pointer (pivotheaptid) at runtime (release version).

itemptr.h:
#define ItemPointerCopy(fromPointer, toPointer) \
( \
AssertMacro(PointerIsValid(toPointer)), \
AssertMacro(PointerIsValid(fromPointer)), \
*(toPointer) = *(fromPointer) \
)

regards,
Ranier Vilela

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Ranier Vilela 2020-09-02 21:46:40 Re: [NBTREE] Possible NULL pointer dereference (backend/access/nbtree/nbutils.c)
Previous Message Jesse Zhang 2020-09-02 21:32:20 Re: Fix for configure error in 9.5/9.6 on macOS 11.0 Big Sur