Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1pnjM8-0006HQ-Bs for pgsql-bugs@arkaria.postgresql.org; Sat, 15 Apr 2023 17:06:32 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1pnjM7-00011Y-8o for pgsql-bugs@arkaria.postgresql.org; Sat, 15 Apr 2023 17:06:31 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1pn032-0001vc-84 for pgsql-bugs@lists.postgresql.org; Thu, 13 Apr 2023 16:43:48 +0000 Received: from azure-sdnproxy.icoremail.net ([20.228.234.168]) by makus.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1pn02y-0006rb-CM for pgsql-bugs@lists.postgresql.org; Thu, 13 Apr 2023 16:43:47 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mails.tsinghua.edu.cn; s=dkim; h=Received:From:To:Cc:Subject: Date:Message-ID:MIME-Version:Content-Type:Content-Language: Thread-Index; bh=qCNeLG4Dg5LfR4UK69ooYzjoZqOZbRj07gnVcV5LD5g=; b=MjAdaFUXrYZJZzELQ+NRkfycJDtU5dqsM7xTB44c8OTd+GvnyIyfNMfPoFUzGX Qem2GDa32mhv168JOtq7Pw03eBHJKEona5B+DoPceuZ7Qs+YYZxDH63NZi/RPPPs /UrQlIyCk2dNIuVGOXve5VexVVLYJiyIG3xZEdfbRdDVY= Received: from LAPTOPJPQFQS7K (unknown [183.172.66.176]) by web4 (Coremail) with SMTP id ywQGZQBXaHI6MThkfeMsEw--.50541S2; Fri, 14 Apr 2023 00:43:38 +0800 (CST) From: To: Cc: , Subject: =?us-ascii?Q?7._PostgreSQL_Server_15.2_=28ASAN_Enabled=29_Subprocess_Went?= =?us-ascii?Q?_down_at_Function_'heap=5Fform=5Ftuple'?= Date: Fri, 14 Apr 2023 00:43:40 +0800 Message-ID: <00c301d96e27$1a7dc410$4f794c30$@mails.tsinghua.edu.cn> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_00C4_01D96E6A.28A23C90" X-Mailer: Microsoft Outlook 16.0 Content-Language: zh-cn Thread-Index: AdluJxkyhYc4zGgqSYyi+S56JK4TxQ== X-CM-TRANSID: ywQGZQBXaHI6MThkfeMsEw--.50541S2 X-Coremail-Antispam: 1UD129KBjvJXoWxCw1xCw1furykuw45Jw4ktFb_yoWrKrykpr 9YyF45CrW8JF1kZFZ2qF15ZrWrJFWkAF17GrnrCr47XrnxGasYgryjyFWYvr1DX3yYkw1U tay8t3yjvw17XaUanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUQIb7Iv0xC_Cr1lb4IE77IF4wAFF20E14v26r1j6r4UM7CY07I2 0VC2zVCF04k26cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28lY4IEw2IIxxk0rw A2F7IY1VAKz4vEj48ve4kI8wA2z4x0Y4vE2Ix0cI8IcVAFwI0_tr0E3s1l84ACjcxK6xII jxv20xvEc7CjxVAFwI0_Cr1j6rxdM28EF7xvwVC2z280aVAFwI0_GcCE3s1l84ACjcxK6I 8E87Iv6xkF7I0E14v26rxl6s0DM2vYz4IE04k24VAvwVAKI4IrM2AIxVAIcxkEcVAq07x2 0xvEncxIr21l5I8CrVAYj202j2C_Wr0_Ar1l5I8CrVAqjxCE14ACF2xKxwAqx4xG64kEw2 xG04xIwI0_Gr0_Xr1l5I8CrVCF0I0E4I0vr24lYx0E2Ix0cI8IcVAFwI0_JF0_Jw1lYx0E x4A2jsIE14v26r1j6r4UMcvjeVCFs4IE7xkEbVWUJVW8JwACjcxG0xvY0x0EwIxGrwAKzV CY07xG64k0F24l7480Y4vEI4kI2Ix0rVAqx4xJMxkIecxEwVAFwVWUMxAIw28IcxkI7VAK I48JMxC20s026xCaFVCjc4AY6r1j6r4UMI8I3I0E5I8CrVAFwI0_JrI_JrWlx2IqxVCjr7 xvwVAFwI0_JrI_JrWlx4CE17CEb7AF67AKxVWUXVWUAwCIc40Y0x0EwIxGrwCI42IY6xII jxv20xvE14v26r1j6r1xMIIF0xvE2Ix0cI8IcVCY1x0267AKxVW8JVWxJwCI42IY6xAIw2 0EY4v20xvaj40_Jr0_JF4lIxAIcVC2z280aVAFwI0_Jr0_Gr1lIxAIcVC2z280aVCY1x02 67AKxVW8JVW8JrUvcSsGvfC2KfnxnUUI43ZEXa7IUn45lUUUUUU== X-CM-SenderInfo: him2jjo6pdxz3vow2x5qjk3toohg3hdfq/ List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk This is a multipart message in MIME format. ------=_NextPart_000_00C4_01D96E6A.28A23C90 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Description: PostgreSQL Server (ASAN Enabled) Subprocess Went down at Function 'heap_form_tuple' PostgreSQL Server Version: PostgreSQL 15.2 on x86_64-pc-linux-gnu, compiled by Ubuntu clang version 12.0.1, 64-bit Discoverer: Jingzhou Fu, Jie Liang and Zhiyong Wu in WingTecher Lab of Tsinghua University and Shuimuyulin ltd Email address: fjz22@mails.tsinghua.edu.cn , wuzy21@mails.tsinghua.edu.cn , ljiee@mail.tsinghua.edu.cn PoC: ```sql SET allow_system_table_mods = on; CREATE TABLE test_pg_dump_t1 (test_pg_dump_v1 int); ALTER TABLE pg_description ADD COLUMN transaction_test6 int; COMMENT ON COLUMN test_pg_dump_t1.test_pg_dump_v1 IS 'test_pg_dump_v1'; ``` Backtrace: ``` ==3273==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffdf0cd4484 at pc 0x00000059305c bp 0x7ffdf0cd4120 sp 0x7ffdf0cd4118 READ of size 1 at 0x7ffdf0cd4484 thread T0 #0 0x59305b in heap_form_tuple (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x59305b) #1 0xbfb595 in CreateComments (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0xbfb595) #2 0xbfa81b in CommentObject (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0xbfa81b) #3 0x1705df5 in ProcessUtilitySlow (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x1705df5) #4 0x16fc933 in standard_ProcessUtility (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x16fc933) #5 0x16fa616 in ProcessUtility (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x16fa616) #6 0x16f9666 in PortalRunUtility (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x16f9666) #7 0x16f7605 in PortalRunMulti (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x16f7605) #8 0x16f559a in PortalRun (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x16f559a) #9 0x16e9693 in exec_simple_query (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x16e9693) #10 0x16e7a62 in PostgresMain (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x16e7a62) #11 0x144c17a in BackendRun (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x144c17a) #12 0x144ad84 in BackendStartup (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x144ad84) #13 0x14481e5 in ServerLoop (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x14481e5) #14 0x1443e0e in PostmasterMain (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x1443e0e) #15 0x106ebf1 in main (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x106ebf1) #16 0x7f2f8fe4e082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16 #17 0x49fc0d in _start (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x49fc0d) Address 0x7ffdf0cd4484 is located in stack of thread T0 at offset 388 in frame #0 0xbfafef in CreateComments (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0xbfafef) This frame has 4 object(s): [32, 248) 'skey' [320, 352) 'values' [384, 388) 'nulls' <== Memory access at offset 388 overflows this variable [400, 404) 'replaces' HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork (longjmp and C++ exceptions *are* supported) SUMMARY: AddressSanitizer: stack-buffer-overflow (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x59305b) in heap_form_tuple Shadow bytes around the buggy address: 0x10003e192840: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10003e192850: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10003e192860: f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00 00 0x10003e192870: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f2 0x10003e192880: f2 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 f2 f2 f2 f2 =>0x10003e192890:[04]f2 04 f3 00 00 00 00 00 00 00 00 00 00 00 00 0x10003e1928a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10003e1928b0: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 0x10003e1928c0: 00 04 f2 f2 00 f2 f2 f2 f8 f8 f2 f2 00 00 f2 f2 0x10003e1928d0: 00 00 f2 f2 00 00 f3 f3 00 00 00 00 00 00 00 00 0x10003e1928e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==3273==ABORTING ``` ------=_NextPart_000_00C4_01D96E6A.28A23C90 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Description:<= /span> PostgreSQL = Server (ASAN Enabled) Subprocess Went down at Function = ‘heap_form_tuple’

PostgreSQL = Server Version: PostgreSQL 15.2 on x86_64-pc-linux-gnu, compiled by = Ubuntu clang version 12.0.1, 64-bit

Discoverer: = Jingzhou Fu, Jie Liang and Zhiyong Wu in WingTecher Lab of Tsinghua = University and Shuimuyulin ltd

Email = address: fjz22@mails.tsinghua.edu.cn  ,   wuzy21@mails.tsinghua.edu.cn&n= bsp; ,  = ljiee@mail.tsinghua.edu.cn

 

PoC:

```sql

SET = allow_system_table_mods =3D on;

CREATE TABLE = test_pg_dump_t1 (test_pg_dump_v1 int);

ALTER TABLE = pg_description ADD COLUMN transaction_test6 int;

COMMENT ON = COLUMN test_pg_dump_t1.test_pg_dump_v1 IS = 'test_pg_dump_v1';

```

 

Backtrace:

```

=3D=3D3273=3D= =3DERROR: AddressSanitizer: stack-buffer-overflow on address = 0x7ffdf0cd4484 at pc 0x00000059305c bp 0x7ffdf0cd4120 sp = 0x7ffdf0cd4118

READ of size = 1 at 0x7ffdf0cd4484 thread T0

  &= nbsp; #0 0x59305b in heap_form_tuple = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x59305b)

  &= nbsp; #1 0xbfb595 in CreateComments = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0xbfb595)

  &= nbsp; #2 0xbfa81b in CommentObject = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0xbfa81b)

  &= nbsp; #3 0x1705df5 in ProcessUtilitySlow = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x1705df5)

  &= nbsp; #4 0x16fc933 in standard_ProcessUtility = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x16fc933)

  &= nbsp; #5 0x16fa616 in ProcessUtility = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x16fa616)

  &= nbsp; #6 0x16f9666 in PortalRunUtility = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x16f9666)

  &= nbsp; #7 0x16f7605 in PortalRunMulti = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x16f7605)

  &= nbsp; #8 0x16f559a in PortalRun = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x16f559a)

  &= nbsp; #9 0x16e9693 in exec_simple_query = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x16e9693)

  &= nbsp; #10 0x16e7a62 in PostgresMain = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x16e7a62)

  &= nbsp; #11 0x144c17a in BackendRun = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x144c17a)

  &= nbsp; #12 0x144ad84 in BackendStartup = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x144ad84)

  &= nbsp; #13 0x14481e5 in ServerLoop = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x14481e5)

  &= nbsp; #14 0x1443e0e in PostmasterMain = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x1443e0e)

  &= nbsp; #15 0x106ebf1 in main = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x106ebf1)

  &= nbsp; #16 0x7f2f8fe4e082 in __libc_start_main = /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16<= /span>

  &= nbsp; #17 0x49fc0d in _start = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x49fc0d)

 

Address = 0x7ffdf0cd4484 is located in stack of thread T0 at offset 388 in = frame

  &= nbsp; #0 0xbfafef in CreateComments = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0xbfafef)

 

  This = frame has 4 object(s):

  &= nbsp; [32, 248) 'skey'

  &= nbsp; [320, 352) 'values'

  &= nbsp; [384, 388) 'nulls' <=3D=3D Memory access at offset 388 = overflows this variable

  &= nbsp; [400, 404) 'replaces'

HINT: this = may be a false positive if your program uses some custom stack unwind = mechanism, swapcontext or vfork

  &= nbsp;   (longjmp and C++ exceptions *are* = supported)

SUMMARY: = AddressSanitizer: stack-buffer-overflow = (/root/bin_original_asan/usr/local/pgsql/bin/postgres+0x59305b) in = heap_form_tuple

Shadow bytes = around the buggy address:

  = 0x10003e192840: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 = 00

  = 0x10003e192850: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 = 00

  = 0x10003e192860: f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00 = 00

  = 0x10003e192870: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 = f2

  = 0x10003e192880: f2 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 f2 f2 f2 = f2

=3D>0x1000= 3e192890:[04]f2 04 f3 00 00 00 00 00 00 00 00 00 00 00 = 00

  = 0x10003e1928a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 = 00

  = 0x10003e1928b0: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 = f1

  = 0x10003e1928c0: 00 04 f2 f2 00 f2 f2 f2 f8 f8 f2 f2 00 00 f2 = f2

  = 0x10003e1928d0: 00 00 f2 f2 00 00 f3 f3 00 00 00 00 00 00 00 = 00

  = 0x10003e1928e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 = 00

Shadow byte = legend (one shadow byte represents 8 application = bytes):

  = Addressable:           = 00

  = Partially addressable: 01 02 03 04 05 06 07

  H= eap left redzone:       = fa

  Freed = heap region:       = fd

  Stack = left redzone:      f1

  Stack = mid redzone:       = f2

  Stack = right redzone:     f3

  Stack = after return:      f5

  Stack = use after scope:   f8

  = Global redzone:          = f9

  = Global init order:       = f6

  = Poisoned by user:        = f7

  = Container overflow:      = fc

  Array = cookie:           = ac

  Intra = object redzone:    bb

  ASan = internal:           = fe

  Left = alloca redzone:     ca

  Right = alloca redzone:    cb

  = Shadow = gap:           &nb= sp;  cc

=3D=3D3273=3D= =3DABORTING

```

 

------=_NextPart_000_00C4_01D96E6A.28A23C90--