[Chao Li <li.evan.chao@gmail.com>]

Hi,

This has been in my notes for a while. MemoryContextAllocAligned() calls MemoryContextAllocExtended() and passes “flags" with only MCXT_ALLOC_ZERO removed. When “flags" includes MCXT_ALLOC_NO_OOM, MemoryContextAllocExtended() may return NULL, but MemoryContextAllocAligned() doesn't handle the returned NULL, which may
lead to a crash.

AlignedAllocRealloc() wraps MemoryContextAllocAligned() and handles a NULL return from it, which I think further supports that this is a bug.

I didn't find an in-tree call site that passes MCXT_ALLOC_NO_OOM to MemoryContextAllocAligned() or palloc_aligned(), so this cannot be triggered from current core code. However, a third-party extension could hit the bug.

The attached patch is a quick fix that adds a NULL check.

Best regards,
--
Chao Li (Evan)
HighGo Software Co., Ltd.
https://www.highgo.com/

Attachments:

v1-0001-Fix-NO_OOM-handling-in-MemoryContextAllocAligned.patch (application/octet-stream, 1.5K) download
From e9e7bf36bf8122277cee7b6b74a9cba8bc10b17f Mon Sep 17 00:00:00 2001
From: "Chao Li (Evan)" <lic@highgo.com>
Date: Mon, 3 Aug 2026 16:21:23 +0800
Subject: [PATCH v1] Fix NO_OOM handling in MemoryContextAllocAligned

MemoryContextAllocAligned() passes its flags through to
MemoryContextAllocExtended(), except for MCXT_ALLOC_ZERO. Therefore, when
MCXT_ALLOC_NO_OOM is specified, the underlying allocation can return NULL.

The aligned-allocation path did not check for that case before computing the
aligned pointer and setting up the redirection MemoryChunk. That could perform
pointer arithmetic from NULL and then access an invalid chunk header, instead
of returning NULL to the caller.

Return NULL immediately when the underlying allocation fails. This also lets
AlignedAllocRealloc() handle the failure as intended when repalloc_extended()
is used on an aligned allocation with MCXT_ALLOC_NO_OOM.

Author: Chao Li <lic@highgo.com>
---
 src/backend/utils/mmgr/mcxt.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/backend/utils/mmgr/mcxt.c b/src/backend/utils/mmgr/mcxt.c
index 930fc457328..fe5c2d8e01b 100644
--- a/src/backend/utils/mmgr/mcxt.c
+++ b/src/backend/utils/mmgr/mcxt.c
@@ -1540,6 +1540,8 @@ MemoryContextAllocAligned(MemoryContext context,
 	 */
 	unaligned = MemoryContextAllocExtended(context, alloc_size,
 										   flags & ~MCXT_ALLOC_ZERO);
+	if (unlikely(unaligned == NULL))
+		return NULL;
 
 	/* compute the aligned pointer */
 	aligned = (void *) TYPEALIGN(alignto, (char *) unaligned +
-- 
2.50.1 (Apple Git-155)

=