pg.ddx.io pgsql-bugs@postgresql.org mailing list archive
help / color / mirror / Atom feedBUG #17816: Invalid memory access in translate function
2+ messages / 2 participants
[nested] [flat]
Commits from this thread:
2023-03-01 b162660d3a b1a9d8ef25 3b37e84422 eae09137d5 1a9356f657 d7056bc1c7 Avoid fetching one past the end of translate()'s "to" parameter.
* BUG #17816: Invalid memory access in translate function
@ 2023-03-01 08:17 PG Bug reporting form <noreply@postgresql.org>
0 siblings, 1 reply; 2+ messages in thread
From: PG Bug reporting form @ 2023-03-01 08:17 UTC (permalink / raw)
To: pgsql-bugs@lists.postgresql.org; +Cc: anisimow.d@gmail.com
The following bug has been logged on the website:
Bug reference: 17816
Logged by: Daniil Anisimov
Email address: anisimow.d@gmail.com
PostgreSQL version: 15.2
Operating system: Ubuntu 22.04.2 LTS
Description:
When running this query in psql with valgrind-enabled server:
select translate('(123)', '()', '');
I get:
==00:00:00:05.576 29520== Invalid read of size 1
==00:00:00:05.576 29520== at 0x7605BE: pg_utf_mblen (wchar.c:553)
==00:00:00:05.576 29520== by 0x71CEDE: pg_mblen (mbutils.c:968)
==00:00:00:05.576 29520== by 0x67B1E3: translate (oracle_compat.c:864)
==00:00:00:05.576 29520== by 0x3FE8AB: ExecInterpExpr
(execExprInterp.c:751)
==00:00:00:05.576 29520== by 0x3FB0B1: ExecInterpExprStillValid
(execExprInterp.c:1826)
==00:00:00:05.576 29520== by 0x4EC87F: ExecEvalExprSwitchContext
(executor.h:341)
==00:00:00:05.576 29520== by 0x4EC87F: evaluate_expr (clauses.c:4823)
==00:00:00:05.576 29520== by 0x4ECA5B: evaluate_function
(clauses.c:4325)
==00:00:00:05.576 29520== by 0x4EEF13: simplify_function
(clauses.c:3908)
==00:00:00:05.576 29520== by 0x4ECD1F: eval_const_expressions_mutator
(clauses.c:2427)
==00:00:00:05.576 29520== by 0x47DB6C: expression_tree_mutator
(nodeFuncs.c:3080)
==00:00:00:05.576 29520== by 0x4EE159: eval_const_expressions_mutator
(clauses.c:3527)
==00:00:00:05.576 29520== by 0x47DDB6: expression_tree_mutator
(nodeFuncs.c:3166)
==00:00:00:05.576 29520== Address 0x6f541d4 is 7,156 bytes inside a block
of size 8,192 alloc'd
==00:00:00:05.576 29520== at 0x4848899: malloc (in
/usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==00:00:00:05.576 29520== by 0x732BCF: AllocSetContextCreateInternal
(aset.c:469)
==00:00:00:05.576 29520== by 0x51F8D2: PostmasterMain
(postmaster.c:612)
==00:00:00:05.576 29520== by 0x464A71: main (main.c:202)
==00:00:00:05.576 29520==
{
<insert_a_suppression_name_here>
Memcheck:Addr1
fun:pg_utf_mblen
fun:pg_mblen
fun:translate
fun:ExecInterpExpr
fun:ExecInterpExprStillValid
fun:ExecEvalExprSwitchContext
fun:evaluate_expr
fun:evaluate_function
fun:simplify_function
fun:eval_const_expressions_mutator
fun:expression_tree_mutator
fun:eval_const_expressions_mutator
fun:expression_tree_mutator
}
==00:00:00:05.576 29520==
==00:00:00:05.576 29520== Exit program on first error
(--exit-on-first-error=yes)
In the translate() function in src/backend/utils/adt/oracle_compat.c used
pg_mblen(p) even if p has zero length:
for (i = 0; i < from_index; i++)
{
p += pg_mblen(p);
if (p >= (to_ptr + tolen))
break;
}
These changes fix the issue:
for (i = 0; i < from_index; i++)
{
if (p >= (to_ptr + tolen))
break;
p += pg_mblen(p);
}
^ permalink raw reply [nested|flat] 2+ messages in thread
* Re: BUG #17816: Invalid memory access in translate function
@ 2023-03-01 15:46 Tom Lane <tgl@sss.pgh.pa.us>
parent: PG Bug reporting form <noreply@postgresql.org>
0 siblings, 0 replies; 2+ messages in thread
From: Tom Lane @ 2023-03-01 15:46 UTC (permalink / raw)
To: anisimow.d@gmail.com; +Cc: pgsql-bugs@lists.postgresql.org
PG Bug reporting form <noreply@postgresql.org> writes:
> When running this query in psql with valgrind-enabled server:
> select translate('(123)', '()', '');
> I get:
> ==00:00:00:05.576 29520== Invalid read of size 1
> ==00:00:00:05.576 29520== at 0x7605BE: pg_utf_mblen (wchar.c:553)
> ==00:00:00:05.576 29520== by 0x71CEDE: pg_mblen (mbutils.c:968)
> ==00:00:00:05.576 29520== by 0x67B1E3: translate (oracle_compat.c:864)
Thanks for the report!
> These changes fix the issue:
> for (i = 0; i < from_index; i++)
> {
> if (p >= (to_ptr + tolen))
> break;
> p += pg_mblen(p);
> }
Yeah, I agree, we need to switch the order of those two statements.
Will fix.
(Might be worth pulling out the common subexpression here?
I wonder if all compilers are smart enough to evaluate to_ptr + to_len
just once.)
regards, tom lane
^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2023-03-01 15:46 UTC | newest]
Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2023-03-01 08:17 BUG #17816: Invalid memory access in translate function PG Bug reporting form <noreply@postgresql.org>
2023-03-01 15:46 ` Tom Lane <tgl@sss.pgh.pa.us>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox