From: Noah Misch <noah@leadboat.com>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Make palloc_array() and friends safe against integer overflow.
Date: Mon, 11 May 2026 12:19:40 +0000
Message-ID: <E1wMPbo-0002eb-1y@gemulon.postgresql.org> (raw)
Make palloc_array() and friends safe against integer overflow.
Sufficiently large "count" arguments could result in undetected
overflow, causing the allocated memory chunk to be much smaller
than what the caller will subsequently write into it. This is
unlikely to be a hazard with 64-bit size_t but can sometimes
happen on 32-bit builds, primarily where a function allocates
workspace that's significantly larger than its input data.
Rather than trying to patch the at-risk callers piecemeal,
let's just redefine these macros so that they always check.
To do that, move the longstanding add_size() and mul_size() functions
into palloc.h and mcxt.c, and adjust them to not be specific to
shared-memory allocation. Then invent palloc_mul(), palloc0_mul(),
palloc_mul_extended() to use these functions. Actually, the latter
use inlined copies to save one function call. repalloc_array() gets
similar treatment. I didn't bother trying to inline the calls for
repalloc0_array() though.
In v14 and v15, this also adds repalloc_extended(), which previously
was only available in v16 and up.
We need copies of all this in fe_memutils.[hc] as well, since that
module also provides palloc_array() etc.
Reported-by: Xint Code
Author: Tom Lane <tgl@sss.pgh.pa.us>
Reviewed-by: Masahiko Sawada <sawada.mshk@gmail.com>
Backpatch-through: 14
Security: CVE-2026-6473
Branch
------
REL_14_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/61a9b4b6e4f80725216b8234364acdaa7a72a1b1
Author: Tom Lane <tgl@sss.pgh.pa.us>
Modified Files
--------------
src/backend/storage/ipc/shmem.c | 36 -------
src/backend/utils/mmgr/mcxt.c | 196 ++++++++++++++++++++++++++++++++++-----
src/common/fe_memutils.c | 188 +++++++++++++++++++++++++++++++++++++
src/include/common/fe_memutils.h | 28 ++++--
src/include/storage/shmem.h | 2 -
src/include/utils/memutils.h | 1 +
src/include/utils/palloc.h | 22 ++++-
7 files changed, 401 insertions(+), 72 deletions(-)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: noah@leadboat.com, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Make palloc_array() and friends safe against integer overflow.
In-Reply-To: <E1wMPbo-0002eb-1y@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox