agora inbox for pgsql-committers@postgresql.org
help / color / mirror / Atom feedFrom: Heikki Linnakangas <heikki.linnakangas@iki.fi>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Fix SHMEM_ATTACH_UNKNOWN_SIZE when the shmem area doesn't exist
Date: Fri, 18 Sep 2026 09:15:25 +0000
Message-ID: <E1x7Ugn-00000000F9C-3C2z@gemulon.postgresql.org> (raw)
Fix SHMEM_ATTACH_UNKNOWN_SIZE when the shmem area doesn't exist
SHMEM_ATTACH_UNKNOWN_SIZE can be passed as argument to
ShmemRequestStruct() when the caller wants to attach to an existing
shared memory structure whose size it doesn't know. If the shared
memory structure doesn't exist, the request should fail, but instead,
ProcessShmemRequestsAfterStartup() tried to create the structure with
size = -1. That led to integer overflow in ShmemAllocRaw() and memory
corruption.
Fix by rejecting requests with SHMEM_ATTACH_UNKNOWN_SIZE when the
structure doesn't exist. Also add an integer overflow check in
ShmemAllocRaw(), to protect from this kind of confusion or simply too
large requests. Also document SHMEM_ATTACH_UNKNOWN_SIZE.
Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Discussion: https://www.postgresql.org/message-id/CAExHW5u_fTsOAS85kG981Vu6eR1GV-344rup6zYew7xMjEDREw@mail.gmail...
Backpatch-through: 19
Branch
------
REL_19_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/b118f8c841d53f24d9fd159df83a386ea3ce204d
Modified Files
--------------
doc/src/sgml/xfunc.sgml | 10 ++++++++++
src/backend/storage/ipc/shmem.c | 22 ++++++++++++++++++++--
.../modules/test_shmem/t/001_late_shmem_alloc.pl | 17 +++++++++++++++++
src/test/modules/test_shmem/test_shmem.c | 11 +++++++----
4 files changed, 54 insertions(+), 6 deletions(-)
view thread (2+ messages)
Message-ID: <E1x7Ugn-00000000F9C-3C2z@gemulon.postgresql.org>
Permalink: ../E1x7Ugn-00000000F9C-3C2z@gemulon.postgresql.org/
Also on: postgresql.org/message-id/E1x7Ugn-00000000F9C-3C2z@gemulon.postgresql.org
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: heikki.linnakangas@iki.fi, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Fix SHMEM_ATTACH_UNKNOWN_SIZE when the shmem area doesn't exist
In-Reply-To: <E1x7Ugn-00000000F9C-3C2z@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox