pg.ddx.io  pgsql-bugs@postgresql.org mailing list archive  
help / color / mirror / Atom feed
From: PG Bug reporting form <noreply@postgresql.org>
To: pgsql-bugs@lists.postgresql.org
Cc: anisimow.d@gmail.com
Subject: BUG #17816: Invalid memory access in translate function
Date: Wed, 01 Mar 2023 08:17:56 +0000
Message-ID: <17816-70f3d2764e88a108@postgresql.org> (raw)

The following bug has been logged on the website:

Bug reference:      17816
Logged by:          Daniil Anisimov
Email address:      anisimow.d@gmail.com
PostgreSQL version: 15.2
Operating system:   Ubuntu 22.04.2 LTS
Description:        

When running this query in psql with valgrind-enabled server:
select translate('(123)', '()', '');

I get:
==00:00:00:05.576 29520== Invalid read of size 1
==00:00:00:05.576 29520==    at 0x7605BE: pg_utf_mblen (wchar.c:553)
==00:00:00:05.576 29520==    by 0x71CEDE: pg_mblen (mbutils.c:968)
==00:00:00:05.576 29520==    by 0x67B1E3: translate (oracle_compat.c:864)
==00:00:00:05.576 29520==    by 0x3FE8AB: ExecInterpExpr
(execExprInterp.c:751)
==00:00:00:05.576 29520==    by 0x3FB0B1: ExecInterpExprStillValid
(execExprInterp.c:1826)
==00:00:00:05.576 29520==    by 0x4EC87F: ExecEvalExprSwitchContext
(executor.h:341)
==00:00:00:05.576 29520==    by 0x4EC87F: evaluate_expr (clauses.c:4823)
==00:00:00:05.576 29520==    by 0x4ECA5B: evaluate_function
(clauses.c:4325)
==00:00:00:05.576 29520==    by 0x4EEF13: simplify_function
(clauses.c:3908)
==00:00:00:05.576 29520==    by 0x4ECD1F: eval_const_expressions_mutator
(clauses.c:2427)
==00:00:00:05.576 29520==    by 0x47DB6C: expression_tree_mutator
(nodeFuncs.c:3080)
==00:00:00:05.576 29520==    by 0x4EE159: eval_const_expressions_mutator
(clauses.c:3527)
==00:00:00:05.576 29520==    by 0x47DDB6: expression_tree_mutator
(nodeFuncs.c:3166)
==00:00:00:05.576 29520==  Address 0x6f541d4 is 7,156 bytes inside a block
of size 8,192 alloc'd
==00:00:00:05.576 29520==    at 0x4848899: malloc (in
/usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==00:00:00:05.576 29520==    by 0x732BCF: AllocSetContextCreateInternal
(aset.c:469)
==00:00:00:05.576 29520==    by 0x51F8D2: PostmasterMain
(postmaster.c:612)
==00:00:00:05.576 29520==    by 0x464A71: main (main.c:202)
==00:00:00:05.576 29520==
{
   <insert_a_suppression_name_here>
   Memcheck:Addr1
   fun:pg_utf_mblen
   fun:pg_mblen
   fun:translate
   fun:ExecInterpExpr
   fun:ExecInterpExprStillValid
   fun:ExecEvalExprSwitchContext
   fun:evaluate_expr
   fun:evaluate_function
   fun:simplify_function
   fun:eval_const_expressions_mutator
   fun:expression_tree_mutator
   fun:eval_const_expressions_mutator
   fun:expression_tree_mutator
}
==00:00:00:05.576 29520==
==00:00:00:05.576 29520== Exit program on first error
(--exit-on-first-error=yes)

In the translate() function in src/backend/utils/adt/oracle_compat.c used
pg_mblen(p) even if p has zero length:
for (i = 0; i < from_index; i++)
{
	p += pg_mblen(p);
	if (p >= (to_ptr + tolen))
		break;
}

These changes fix the issue:
for (i = 0; i < from_index; i++)
{
	if (p >= (to_ptr + tolen))
		break;
	p += pg_mblen(p);
}



view thread (2+ messages)  latest in thread

Message-ID: <17816-70f3d2764e88a108@postgresql.org>
Permalink:  ../17816-70f3d2764e88a108@postgresql.org/
Also on:    postgresql.org/message-id/17816-70f3d2764e88a108@postgresql.org

 · 

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-bugs@postgresql.org
  Cc: noreply@postgresql.org, pgsql-bugs@lists.postgresql.org, anisimow.d@gmail.com
  Subject: Re: BUG #17816: Invalid memory access in translate function
  In-Reply-To: <17816-70f3d2764e88a108@postgresql.org>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox