agora inbox for pgsql-committers@postgresql.orghelp / color / mirror / Atom feed
pgsql: Fix SHMEM_ATTACH_UNKNOWN_SIZE when the shmem area doesn't exist 2+ messages / 1 participants [nested] [flat]
* pgsql: Fix SHMEM_ATTACH_UNKNOWN_SIZE when the shmem area doesn't exist @ 2026-09-18 09:15 Heikki Linnakangas <heikki.linnakangas@iki.fi> 0 siblings, 0 replies; 2+ messages in thread From: Heikki Linnakangas @ 2026-09-18 09:15 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix SHMEM_ATTACH_UNKNOWN_SIZE when the shmem area doesn't exist SHMEM_ATTACH_UNKNOWN_SIZE can be passed as argument to ShmemRequestStruct() when the caller wants to attach to an existing shared memory structure whose size it doesn't know. If the shared memory structure doesn't exist, the request should fail, but instead, ProcessShmemRequestsAfterStartup() tried to create the structure with size = -1. That led to integer overflow in ShmemAllocRaw() and memory corruption. Fix by rejecting requests with SHMEM_ATTACH_UNKNOWN_SIZE when the structure doesn't exist. Also add an integer overflow check in ShmemAllocRaw(), to protect from this kind of confusion or simply too large requests. Also document SHMEM_ATTACH_UNKNOWN_SIZE. Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com> Discussion: https://www.postgresql.org/message-id/CAExHW5u_fTsOAS85kG981Vu6eR1GV-344rup6zYew7xMjEDREw@mail.gmail... Backpatch-through: 19 Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/311df1dc0392f06973cf98eac51d63cb007267ce Modified Files -------------- doc/src/sgml/xfunc.sgml | 10 ++++++++++ src/backend/storage/ipc/shmem.c | 22 ++++++++++++++++++++-- .../modules/test_shmem/t/001_late_shmem_alloc.pl | 17 +++++++++++++++++ src/test/modules/test_shmem/test_shmem.c | 11 +++++++---- 4 files changed, 54 insertions(+), 6 deletions(-) ^ permalink raw reply [nested|flat] 2+ messages in thread
* pgsql: Fix SHMEM_ATTACH_UNKNOWN_SIZE when the shmem area doesn't exist @ 2026-09-18 09:15 Heikki Linnakangas <heikki.linnakangas@iki.fi> 0 siblings, 0 replies; 2+ messages in thread From: Heikki Linnakangas @ 2026-09-18 09:15 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix SHMEM_ATTACH_UNKNOWN_SIZE when the shmem area doesn't exist SHMEM_ATTACH_UNKNOWN_SIZE can be passed as argument to ShmemRequestStruct() when the caller wants to attach to an existing shared memory structure whose size it doesn't know. If the shared memory structure doesn't exist, the request should fail, but instead, ProcessShmemRequestsAfterStartup() tried to create the structure with size = -1. That led to integer overflow in ShmemAllocRaw() and memory corruption. Fix by rejecting requests with SHMEM_ATTACH_UNKNOWN_SIZE when the structure doesn't exist. Also add an integer overflow check in ShmemAllocRaw(), to protect from this kind of confusion or simply too large requests. Also document SHMEM_ATTACH_UNKNOWN_SIZE. Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com> Discussion: https://www.postgresql.org/message-id/CAExHW5u_fTsOAS85kG981Vu6eR1GV-344rup6zYew7xMjEDREw@mail.gmail... Backpatch-through: 19 Branch ------ REL_19_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/b118f8c841d53f24d9fd159df83a386ea3ce204d Modified Files -------------- doc/src/sgml/xfunc.sgml | 10 ++++++++++ src/backend/storage/ipc/shmem.c | 22 ++++++++++++++++++++-- .../modules/test_shmem/t/001_late_shmem_alloc.pl | 17 +++++++++++++++++ src/test/modules/test_shmem/test_shmem.c | 11 +++++++---- 4 files changed, 54 insertions(+), 6 deletions(-) ^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2026-09-18 09:15 UTC | newest] Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2026-09-18 09:15 pgsql: Fix SHMEM_ATTACH_UNKNOWN_SIZE when the shmem area doesn't exist Heikki Linnakangas <heikki.linnakangas@iki.fi> 2026-09-18 09:15 pgsql: Fix SHMEM_ATTACH_UNKNOWN_SIZE when the shmem area doesn't exist Heikki Linnakangas <heikki.linnakangas@iki.fi>
This inbox is served by agora; see mirroring instructions for how to clone and mirror all data and code used for this inbox