From: | Ashutosh Bapat <ashutosh(dot)bapat(dot)oss(at)gmail(dot)com> |
---|---|
To: | Ranier Vilela <ranier(dot)vf(at)gmail(dot)com> |
Cc: | Pg Hackers <pgsql-hackers(at)postgresql(dot)org> |
Subject: | Re: Avoid a possible out-of-bounds access (src/backend/optimizer/util/relnode.c) |
Date: | 2023-09-25 11:23:42 |
Message-ID: | CAExHW5sPF63YGUxny4QRUM0tv_9zdt-jPNLiG8Tr_4a25jfU8Q@mail.gmail.com |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
On Sat, Sep 23, 2023 at 7:29 PM Ranier Vilela <ranier(dot)vf(at)gmail(dot)com> wrote:
>
> Hi,
>
> Per Coverity.
> CID 1518088 (#2 of 2): Improper use of negative value (NEGATIVE_RETURNS)
>
> The function bms_singleton_member can returns a negative number.
>
> /*
> * Get a child rel for rel2 with the relids. See above comments.
> */
> if (rel2_is_simple)
> {
> int varno = bms_singleton_member(child_relids2);
>
> child_rel2 = find_base_rel(root, varno);
> }
>
> It turns out that in the get_matching_part_pairs function (joinrels.c), the return of bms_singleton_member is passed to the find_base_rel function, which cannot receive a negative value.
>
> find_base_rel is protected by an Assertion, which effectively indicates that the error does not occur in tests and in DEBUG mode.
>
> But this does not change the fact that bms_singleton_member can return a negative value, which may occur on some production servers.
>
> Fix by changing the Assertion into a real test, to protect the simple_rel_array array.
Do you have a scenario where bms_singleton_member() actually returns a
-ve number OR it's just a possibility. bms_make_singleton() has an
assertion at the end: Assert(result >= 0);
bms_make_singleton(), bms_add_member() explicitly forbids negative
values. It looks like we have covered all the places which can add a
negative value to a bitmapset. May be we are missing a place or two.
It will be good to investigate it.
What you are suggesting may be ok, as is as well.
--
Best Wishes,
Ashutosh Bapat
From | Date | Subject | |
---|---|---|---|
Next Message | Nazir Bilal Yavuz | 2023-09-25 11:56:28 | Re: Build the docs if there are changes in docs and don't run other tasks if the changes are only in docs |
Previous Message | Hayato Kuroda (Fujitsu) | 2023-09-25 11:01:08 | RE: [PoC] pg_upgrade: allow to upgrade publisher node |