postgres.git / summary / log / commit / refs

commit    bcc428a23a69ee6f3bcc2ce20655da68eed0e7aa
Author:   Robert Haas <rhaas@postgresql.org>
Date:     Wed Jul 15 17:04:32 2026 +0000
First released in: 17.11, 18.6

    Add additional sanity checks when reading a blkreftable.
    
    Code elsewhere in the system assumes that fork numbers and chunk sizes
    are within bounds, so the code that reads those quantities from disk
    should validate that they are. Without these additional checks, a
    corrupted file can cause us to index off the end of fork number or chunk
    entry arrays, potentially resulting in a crash.
    
    Reported-by: oxsignal <awo@kakao.com> (chunk sizes)
    Reported-by: Robert Haas <rhaas@postgresql.org> (fork numbers)
    Reviewed-by: Daniel Gustafsson <daniel@yesql.se>
    Discussion: http://postgr.es/m/CA+TgmoYP8RKoBGosS7C6Fdr-GNCfyz_W1zmK=Tx1Fe0ZvzGh0g@mail.gmail.com
    Backpatch-through: 17


 src/common/blkreftable.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/src/common/blkreftable.c b/src/common/blkreftable.c
index 5c85d6a5c6d..b33687a9f36 100644
--- a/src/common/blkreftable.c
+++ b/src/common/blkreftable.c
@@ -657,6 +657,15 @@ BlockRefTableReaderNextRelation(BlockRefTableReader *reader,
 		return false;
 	}
 
+	/* Sanity-check the fork number. */
+	if (sentry.forknum < 0 || sentry.forknum > MAX_FORKNUM)
+	{
+		reader->error_callback(reader->error_callback_arg,
+							   "file \"%s\" has invalid fork number %d",
+							   reader->error_filename, sentry.forknum);
+		return false;
+	}
+
 	/*
 	 * Sanity-check the nchunks value.  In the backend, palloc_array would
 	 * enforce this anyway (with a more generic error message); but in
@@ -678,6 +687,19 @@ BlockRefTableReaderNextRelation(BlockRefTableReader *reader,
 	BlockRefTableRead(reader, reader->chunk_size,
 					  sentry.nchunks * sizeof(uint16));
 
+	/* Sanity-check the chunk sizes. */
+	for (unsigned i = 0; i < sentry.nchunks; ++i)
+	{
+		if (reader->chunk_size[i] > MAX_ENTRIES_PER_CHUNK)
+		{
+			reader->error_callback(reader->error_callback_arg,
+								   "file \"%s\" chunk %u has invalid size %u",
+								   reader->error_filename, i,
+								   (unsigned) reader->chunk_size[i]);
+			return false;
+		}
+	}
+
 	/* Set up for chunk scan. */
 	reader->total_chunks = sentry.nchunks;
 	reader->consumed_chunks = 0;


[parent: ae8c4bd558c5]