From: Tom Lane <tgl@sss.pgh.pa.us>
To: Flavien GUEDEZ <flav.pg@oopacity.net>
Cc: pgsql-bugs@lists.postgresql.org
Subject: Re: Insufficient memory access checks in pglz_decompress
Date: Wed, 18 Oct 2023 11:14:27 -0400
Message-ID: <3116807.1697642067@sss.pgh.pa.us> (raw)
In-Reply-To: <01fc0593-e31e-463d-902c-dd43174acee2@oopacity.net>
References: <01fc0593-e31e-463d-902c-dd43174acee2@oopacity.net>
Flavien GUEDEZ <flav.pg@oopacity.net> writes:
> After some investigations about very corrupted toast data in one
> postgres instance, I found that the pglz_decompress function (in
> common/pg_lzcompress.c) does not check correctly where it copies data
> from using memcpy(), which could result in segfault.
> In this function, there are other checks to ensure that we do not copy
> after the destination end, but not if we copy data from "before the
> beginning".
Hmm, would it not be better to add this check to the existing "Check for
corrupt data" a bit further up? Then you'd only need one instance of
the test, and only need to do it once per tag (note the comment pointing
out that dp - off stays the same), and overall it'd be less surprising IMO.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: tgl@sss.pgh.pa.us, flav.pg@oopacity.net, pgsql-bugs@lists.postgresql.org
Subject: Re: Insufficient memory access checks in pglz_decompress
In-Reply-To: <3116807.1697642067@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox