postgres.git / summary / log / commit / refs

commit    7f69ed4aebe342365dc7db96f33b473dec9f054b
Author:   Andrew Gierth <rhodiumtoad@postgresql.org>
Date:     Thu Nov 12 14:34:37 2020 +0000
First released in: 14.0, 9.5.25, 9.6.21, 10.16, 11.11, 12.6, 13.2

    pg_trgm: fix crash in 2-item picksplit
    
    Whether from size overflow in gistSplit or from secondary splits,
    picksplit is (rarely) called with exactly two items to split.
    
    Formerly, due to special-case handling of the last item, this would
    lead to access to an uninitialized cache entry; prior to PG 13 this
    might have been harmless or at worst led to an incorrect union datum,
    but in 13 onwards it can cause a backend crash from using an
    uninitialized pointer.
    
    Repair by removing the special case, which was deemed not to have been
    appropriate anyway. Backpatch all the way, because this bug has
    existed since pg_trgm was added.
    
    Per report on IRC from user "ftzdomino". Analysis and testing by me,
    patch from Alexander Korotkov.
    
    Discussion: https://postgr.es/m/87k0usfdxg.fsf@news-spur.riddles.org.uk


 contrib/pg_trgm/trgm_gist.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/contrib/pg_trgm/trgm_gist.c b/contrib/pg_trgm/trgm_gist.c
index e79db8a4f03..6e1cb7ec9fc 100644
--- a/contrib/pg_trgm/trgm_gist.c
+++ b/contrib/pg_trgm/trgm_gist.c
@@ -760,7 +760,7 @@ Datum
 gtrgm_picksplit(PG_FUNCTION_ARGS)
 {
 	GistEntryVector *entryvec = (GistEntryVector *) PG_GETARG_POINTER(0);
-	OffsetNumber maxoff = entryvec->n - 2;
+	OffsetNumber maxoff = entryvec->n - 1;
 	GIST_SPLITVEC *v = (GIST_SPLITVEC *) PG_GETARG_POINTER(1);
 	OffsetNumber k,
 				j;
@@ -783,7 +783,7 @@ gtrgm_picksplit(PG_FUNCTION_ARGS)
 	SPLITCOST  *costvector;
 
 	/* cache the sign data for each existing item */
-	cache = (CACHESIGN *) palloc(sizeof(CACHESIGN) * (maxoff + 2));
+	cache = (CACHESIGN *) palloc(sizeof(CACHESIGN) * (maxoff + 1));
 	for (k = FirstOffsetNumber; k <= maxoff; k = OffsetNumberNext(k))
 		fillcache(&cache[k], GETENTRY(entryvec, k));
 
@@ -810,7 +810,7 @@ gtrgm_picksplit(PG_FUNCTION_ARGS)
 	}
 
 	/* initialize the result vectors */
-	nbytes = (maxoff + 2) * sizeof(OffsetNumber);
+	nbytes = maxoff * sizeof(OffsetNumber);
 	v->spl_left = left = (OffsetNumber *) palloc(nbytes);
 	v->spl_right = right = (OffsetNumber *) palloc(nbytes);
 	v->spl_nleft = 0;
@@ -846,8 +846,7 @@ gtrgm_picksplit(PG_FUNCTION_ARGS)
 
 	union_l = GETSIGN(datum_l);
 	union_r = GETSIGN(datum_r);
-	maxoff = OffsetNumberNext(maxoff);
-	fillcache(&cache[maxoff], GETENTRY(entryvec, maxoff));
+
 	/* sort before ... */
 	costvector = (SPLITCOST *) palloc(sizeof(SPLITCOST) * maxoff);
 	for (j = FirstOffsetNumber; j <= maxoff; j = OffsetNumberNext(j))
@@ -933,7 +932,6 @@ gtrgm_picksplit(PG_FUNCTION_ARGS)
 		}
 	}
 
-	*right = *left = FirstOffsetNumber;
 	v->spl_ldatum = PointerGetDatum(datum_l);
 	v->spl_rdatum = PointerGetDatum(datum_r);
 


[parent: 0d0626e27d56]