pg.ddx.io pgsql-bugs@postgresql.org mailing list archive
help / color / mirror / Atom feedBUG #18896: A potential problem in heap_page_items (pageinspect, PG-17)
2+ messages / 2 participants
[nested] [flat]
* BUG #18896: A potential problem in heap_page_items (pageinspect, PG-17)
@ 2025-04-16 20:21 PG Bug reporting form <noreply@postgresql.org>
2025-04-19 19:33 ` Re: BUG #18896: A potential problem in heap_page_items (pageinspect, PG-17) Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 1 reply; 2+ messages in thread
From: PG Bug reporting form @ 2025-04-16 20:21 UTC (permalink / raw)
To: pgsql-bugs@lists.postgresql.org; +Cc: d.kovalenko@postgrespro.ru
The following bug has been logged on the website:
Bug reference: 18896
Logged by: Dmitry Kovalenko
Email address: d.kovalenko@postgrespro.ru
PostgreSQL version: 17.4
Operating system: Ubuntu 2024.04
Description:
Hello,
Please, look at this code in heap_page_items function:
https://github.com/postgres/postgres/blob/11ff192b5bb707ba9ec13a0b6c7468874403abb3/contrib/pageinspe...
If lp_len value is less than tuphdr->t_hoff, we get a problem with negative
value in tuple_data_len
I think, we should move the code of /* Copy raw tuple data into bytea
attribute */ into the next if (.... tuphdr->t_hoff <= lp_len ....)
section.
And set nulls[13] = true; to else section here -
https://github.com/postgres/postgres/blob/11ff192b5bb707ba9ec13a0b6c7468874403abb3/contrib/pageinspe...
-------- [copy of problem block at lines 231 ... 248]
/* Copy raw tuple data into bytea attribute */
tuple_data_len = lp_len - tuphdr->t_hoff; // < -----------------
SUBSTRACT
tuple_data_bytea = (bytea *) palloc(tuple_data_len + VARHDRSZ);
SET_VARSIZE(tuple_data_bytea, tuple_data_len + VARHDRSZ);
memcpy(VARDATA(tuple_data_bytea), (char *) tuphdr + tuphdr->t_hoff,
tuple_data_len); // < ------------------- USAGE
values[13] = PointerGetDatum(tuple_data_bytea);
/*
* We already checked that the item is completely within the raw
* page passed to us, with the length given in the line pointer.
* Let's check that t_hoff doesn't point over lp_len, before using
* it to access t_bits and oid.
*/
if (tuphdr->t_hoff >= SizeofHeapTupleHeader &&
tuphdr->t_hoff <= lp_len && // < ------------------ VERIFICATION
tuphdr->t_hoff == MAXALIGN(tuphdr->t_hoff))
{
--------
I hope, this problem can be fixed really easily.
Thanks&Regards,
Kovalenko Dmitry
PostgresPro, Russia.
^ permalink raw reply [nested|flat] 2+ messages in thread
* Re: BUG #18896: A potential problem in heap_page_items (pageinspect, PG-17)
2025-04-16 20:21 BUG #18896: A potential problem in heap_page_items (pageinspect, PG-17) PG Bug reporting form <noreply@postgresql.org>
@ 2025-04-19 19:33 ` Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 0 replies; 2+ messages in thread
From: Tom Lane @ 2025-04-19 19:33 UTC (permalink / raw)
To: d.kovalenko@postgrespro.ru; +Cc: pgsql-bugs@lists.postgresql.org
PG Bug reporting form <noreply@postgresql.org> writes:
> Please, look at this code in heap_page_items function:
> https://github.com/postgres/postgres/blob/11ff192b5bb707ba9ec13a0b6c7468874403abb3/contrib/pageinspe...
> If lp_len value is less than tuphdr->t_hoff, we get a problem with negative
> value in tuple_data_len
Yeah, you're right.
> I think, we should move the code of /* Copy raw tuple data into bytea
> attribute */ into the next if (.... tuphdr->t_hoff <= lp_len ....)
> section.
Agreed, that looks like a good fix. I'll make it so.
regards, tom lane
^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2025-04-19 19:33 UTC | newest]
Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2025-04-16 20:21 BUG #18896: A potential problem in heap_page_items (pageinspect, PG-17) PG Bug reporting form <noreply@postgresql.org>
2025-04-19 19:33 ` Tom Lane <tgl@sss.pgh.pa.us>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox