postgres.git / summary / log / commit / refs

commit    59759e1a5b499294d73d409e0bc3343aafd2973f
Author:   Noah Misch <noah@leadboat.com>
Date:     Sun May 17 01:01:35 2026 +0000
First released in: 14.24, 15.19, 16.15, 17.11, 18.6

    Use ereport(ERROR), not Assert(), for publisher tuples missing columns.
    
    Three locations use Assert() to guard against a mismatch between the
    number of columns advertised in the RELATION message and the number
    actually received in the subsequent INSERT/UPDATE tuple message. Since
    these values originate from the publisher, the check must survive into
    production builds.
    
    A malicious or buggy publisher can send a RELATION claiming N columns
    and an INSERT claiming M < N columns. The subscriber's apply worker
    indexes into colvalues[]/colstatus[] using column indices from the
    RELATION message's attribute map, causing a heap out-of-bounds read when
    the tuple's column array is smaller than expected. We've looked, without
    success, for a scenario in which the publisher holds sufficient control
    over these out-of-bounds bytes to exploit this or even to reach a
    SIGSEGV. Despite not finding one, the code has been fragile. Back-patch
    to v14 (all supported versions).
    
    Reported-by: Varik Matevosyan <varikmatevosyan@gmail.com>
    Author: Varik Matevosyan <varikmatevosyan@gmail.com>
    Discussion: https://postgr.es/m/CA+bBoog3cCogktzfLb9bppUByu-10B3CFp8u=iKXG_OvtAguCw@mail.gmail.com
    Backpatch-through: 14


 src/backend/replication/logical/worker.c | 23 +++++++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

diff --git a/src/backend/replication/logical/worker.c b/src/backend/replication/logical/worker.c
index d6bbffd7c8d..996883331fd 100644
--- a/src/backend/replication/logical/worker.c
+++ b/src/backend/replication/logical/worker.c
@@ -824,9 +824,15 @@ slot_store_data(TupleTableSlot *slot, LogicalRepRelMapEntry *rel,
 
 		if (!att->attisdropped && remoteattnum >= 0)
 		{
-			StringInfo	colvalue = &tupleData->colvalues[remoteattnum];
+			StringInfo	colvalue;
+
+			if (remoteattnum >= tupleData->ncols)
+				ereport(ERROR,
+						(errcode(ERRCODE_PROTOCOL_VIOLATION),
+						 errmsg("logical replication column %d not found in tuple: only %d column(s) received",
+								remoteattnum + 1, tupleData->ncols)));
 
-			Assert(remoteattnum < tupleData->ncols);
+			colvalue = &tupleData->colvalues[remoteattnum];
 
 			/* Set attnum for error callback */
 			apply_error_callback_arg.remote_attnum = remoteattnum;
@@ -937,7 +943,11 @@ slot_modify_data(TupleTableSlot *slot, TupleTableSlot *srcslot,
 		if (remoteattnum < 0)
 			continue;
 
-		Assert(remoteattnum < tupleData->ncols);
+		if (remoteattnum >= tupleData->ncols)
+			ereport(ERROR,
+					(errcode(ERRCODE_PROTOCOL_VIOLATION),
+					 errmsg("logical replication column %d not found in tuple: only %d column(s) received",
+							remoteattnum + 1, tupleData->ncols)));
 
 		if (tupleData->colstatus[remoteattnum] != LOGICALREP_COLUMN_UNCHANGED)
 		{
@@ -2608,7 +2618,12 @@ apply_handle_update(StringInfo s)
 
 		if (!att->attisdropped && remoteattnum >= 0)
 		{
-			Assert(remoteattnum < newtup.ncols);
+			if (remoteattnum >= newtup.ncols)
+				ereport(ERROR,
+						(errcode(ERRCODE_PROTOCOL_VIOLATION),
+						 errmsg("logical replication column %d not found in tuple: only %d column(s) received",
+								remoteattnum + 1, newtup.ncols)));
+
 			if (newtup.colstatus[remoteattnum] != LOGICALREP_COLUMN_UNCHANGED)
 				target_perminfo->updatedCols =
 					bms_add_member(target_perminfo->updatedCols,


[parent: 2adf78dbe9a2]