From: Kyotaro Horiguchi <horikyota.ntt@gmail.com>
Subject: [PATCH v2] Fix memory overrun of pg_stat_get_slru
Date: Thu, 11 Nov 2021 12:09:45 +0900
The function accesses one element after the end of an array, by
accessing the array using a loop variable before exiting a loop.
Avoid that access by accessing the elements after the check against
the exit condition.
Backpatch to 13, where slru stats was introduced.
---
src/backend/utils/adt/pgstatfuncs.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
inline patch 1: src/backend/utils/adt/pgstatfuncs.c (+2/-1 lines) download inline-1.patchdiff --git a/src/backend/utils/adt/pgstatfuncs.c b/src/backend/utils/adt/pgstatfuncs.cindex ff5aedc99c..e64857e540 100644--- a/src/backend/utils/adt/pgstatfuncs.c+++ b/src/backend/utils/adt/pgstatfuncs.c@@ -1911,7 +1911,7 @@ pg_stat_get_slru(PG_FUNCTION_ARGS)
/* for each row */
Datum values[PG_STAT_GET_SLRU_COLS];
bool nulls[PG_STAT_GET_SLRU_COLS];
- PgStat_SLRUStats stat = stats[i];+ PgStat_SLRUStats stat;
const char *name;
name = pgstat_slru_name(i);
@@ -1919,6 +1919,7 @@ pg_stat_get_slru(PG_FUNCTION_ARGS)
if (!name)
break;
+ stat = stats[i];
MemSet(values, 0, sizeof(values));
MemSet(nulls, 0, sizeof(nulls));
--
2.27.0
----Next_Part(Thu_Nov_11_12_19_09_2021_813)----
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: horikyota.ntt@gmail.com
Subject: Re: [PATCH v2] Fix memory overrun of pg_stat_get_slru
In-Reply-To: <no-message-id-31478@localhost>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox