postgres.git / summary / log / commit / refs

commit    e384118559ef693eaa47ba265627e2e6d8bca843
Author:   Tom Lane <tgl@sss.pgh.pa.us>
Date:     Wed Apr 23 20:04:42 2025 +0000
First released in: 18.0, 16.9, 17.5

    Avoid possibly-theoretical OOM crash hazard in hash_create().
    
    One place in hash_create() used DynaHashAlloc() as a convenient
    shorthand for MemoryContextAlloc().  That was fine when it was
    written, but it stopped being fine when 9c911ec06 changed
    DynaHashAlloc() to use MCXT_ALLOC_NO_OOM (mea culpa).  Change
    the code to call plain MemoryContextAlloc() as intended.
    
    I think that this bug may be unreachable in practice, since we now
    always create AllocSets with some space already allocated, so that
    an OOM failure here for a non-shared hash table should be impossible
    (with a hash table name of reasonable length anyway).  And there
    aren't enough shared hash tables to make a crash for one of those
    probable.  Nonetheless it's clearly not operating as designed, so
    back-patch to v16 where 9c911ec06 came in.
    
    Reported-by: Maksim Korotkov <m.korotkov@postgrespro.ru>
    Author: Tom Lane <tgl@sss.pgh.pa.us>
    Discussion: https://postgr.es/m/219bdccd460510efaccf90b57e5e5ef2@postgrespro.ru
    Backpatch-through: 16


 src/backend/utils/hash/dynahash.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/backend/utils/hash/dynahash.c b/src/backend/utils/hash/dynahash.c
index 145e058fe67..45b8e8e919e 100644
--- a/src/backend/utils/hash/dynahash.c
+++ b/src/backend/utils/hash/dynahash.c
@@ -390,7 +390,8 @@ hash_create(const char *tabname, long nelem, const HASHCTL *info, int flags)
 	}
 
 	/* Initialize the hash header, plus a copy of the table name */
-	hashp = (HTAB *) DynaHashAlloc(sizeof(HTAB) + strlen(tabname) + 1);
+	hashp = (HTAB *) MemoryContextAlloc(CurrentDynaHashCxt,
+										sizeof(HTAB) + strlen(tabname) + 1);
 	MemSet(hashp, 0, sizeof(HTAB));
 
 	hashp->tabname = (char *) (hashp + 1);


[parent: 05676d87e2e6]