pg.ddx.io  pgsql-bugs@postgresql.org mailing list archive  

help / color / mirror / Atom feed

From: Kyotaro Horiguchi <horikyota.ntt@gmail.com>
Subject: [PATCH] Fix memory overrun of pg_stat_get_slru
Date: Thu, 11 Nov 2021 10:10:19 +0900

The function accesses one element after the end of an array, by
accessing the array using a loop variable before exiting a loop.
Avoid that access by ending the loop in a more appropriate way.

Backpatch to 13, where slru stats was introduced.
---
 src/backend/utils/adt/pgstatfuncs.c | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

inline patch 1: src/backend/utils/adt/pgstatfuncs.c (+2/-7 lines) download inline-1.patch
diff --git a/src/backend/utils/adt/pgstatfuncs.c b/src/backend/utils/adt/pgstatfuncs.c
index ff5aedc99c..51fdade9ca 100644
--- a/src/backend/utils/adt/pgstatfuncs.c
+++ b/src/backend/utils/adt/pgstatfuncs.c
@@ -1878,6 +1878,7 @@ pg_stat_get_slru(PG_FUNCTION_ARGS)
 	MemoryContext oldcontext;
 	int			i;
 	PgStat_SLRUStats *stats;
+	const char *name;
 
 	/* check to see if caller supports us returning a tuplestore */
 	if (rsinfo == NULL || !IsA(rsinfo, ReturnSetInfo))
@@ -1906,18 +1907,12 @@ pg_stat_get_slru(PG_FUNCTION_ARGS)
 	/* request SLRU stats from the stat collector */
 	stats = pgstat_fetch_slru();
 
-	for (i = 0;; i++)
+	for (i = 0; (name = pgstat_slru_name(i)) != NULL; i++)
 	{
 		/* for each row */
 		Datum		values[PG_STAT_GET_SLRU_COLS];
 		bool		nulls[PG_STAT_GET_SLRU_COLS];
 		PgStat_SLRUStats stat = stats[i];
-		const char *name;
-
-		name = pgstat_slru_name(i);
-
-		if (!name)
-			break;
 
 		MemSet(values, 0, sizeof(values));
 		MemSet(nulls, 0, sizeof(nulls));
-- 
2.27.0


----Next_Part(Thu_Nov_11_10_39_23_2021_743)----

Message-ID: <no-message-id-31468@localhost>
Permalink:  ../no-message-id-31468@localhost/
Also on:    postgresql.org/message-id/no-message-id-31468@localhost

copy link · copy postgr.es · copy git am

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-bugs@postgresql.org
  Cc: horikyota.ntt@gmail.com
  Subject: Re: [PATCH] Fix memory overrun of pg_stat_get_slru
  In-Reply-To: <no-message-id-31468@localhost>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox