postgres.git / summary / log / commit / refs

commit    95e91da66cf5bbaf46c34c9386c93004f28d6719
Author:   Michael Paquier <michael@paquier.xyz>
Date:     Tue Oct 03 06:37:19 2023 +0000
First released in: 17.0, 12.17, 13.13, 14.10, 15.5, 16.1

    Avoid memory size overflow when allocating backend activity buffer
    
    The code in charge of copying the contents of PgBackendStatus to local
    memory could fail on memory allocation because of an overflow on the
    amount of memory to use.  The overflow can happen when combining a high
    value track_activity_query_size (max at 1MB) with a large
    max_connections, when both multiplied get higher than INT32_MAX as both
    parameters treated as signed integers.  This could for example trigger
    with the following functions, all calling pgstat_read_current_status():
    - pg_stat_get_backend_subxact()
    - pg_stat_get_backend_idset()
    - pg_stat_get_progress_info()
    - pg_stat_get_activity()
    - pg_stat_get_db_numbackends()
    
    The change to use MemoryContextAllocHuge() has been introduced in
    8d0ddccec636, so backpatch down to 12.
    
    Author: Jakub Wartak
    Discussion: https://postgr.es/m/CAKZiRmw8QSNVw2qNK-dznsatQqz+9DkCquxP0GHbbv1jMkGHMA@mail.gmail.com
    Backpatch-through: 12


 src/backend/utils/activity/backend_status.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/backend/utils/activity/backend_status.c b/src/backend/utils/activity/backend_status.c
index c7ed1e6d7ac..3ecb15d74b5 100644
--- a/src/backend/utils/activity/backend_status.c
+++ b/src/backend/utils/activity/backend_status.c
@@ -764,7 +764,8 @@ pgstat_read_current_status(void)
 						   NAMEDATALEN * NumBackendStatSlots);
 	localactivity = (char *)
 		MemoryContextAllocHuge(backendStatusSnapContext,
-							   pgstat_track_activity_query_size * NumBackendStatSlots);
+							   (Size) pgstat_track_activity_query_size *
+							   (Size) NumBackendStatSlots);
 #ifdef USE_SSL
 	localsslstatus = (PgBackendSSLStatus *)
 		MemoryContextAlloc(backendStatusSnapContext,


[parent: afc79591de8e]