pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Nathan Bossart <nathandbossart@gmail.com>
Cc: Mats Kindahl <mats@timescale.com>
Cc: Thomas Munro <thomas.munro@gmail.com>
Cc: Andres Freund <andres@anarazel.de>
Cc: Heikki Linnakangas <hlinnaka@iki.fi>
Cc: pgsql-hackers@lists.postgresql.org
Subject: Re: glibc qsort() vulnerability
Date: Thu, 08 Feb 2024 13:44:02 -0500
Message-ID: <1074897.1707417842@sss.pgh.pa.us> (raw)
In-Reply-To: <20240208183835.GA503311@nathanxps13>
References: <cc9b0272-849a-4a88-8200-59786d18b7a1@iki.fi>
	<20240207214857.rjqkutiaapka2xyp@awork3.anarazel.de>
	<20240207222124.GA382832@nathanxps13>
	<20240208004207.aoyrtv577nmhrivy@awork3.anarazel.de>
	<20240208015211.GA445153@nathanxps13>
	<20240208020637.3irwi5vph4fbxw2f@awork3.anarazel.de>
	<CA+hUKGLbC4O56rtFM69Tx6StT3PcVio9K2GisjZp=z6O20Q3sw@mail.gmail.com>
	<CA+hUKGJaOM5ULeXboxV+fGkU-pYHotL5A10hYxdu8_kwRcVEgQ@mail.gmail.com>
	<20240208025620.GC445153@nathanxps13>
	<CA+14424k0MbdkJuSSLrr1==PYK+oL5Gtq7siTsMgCs+KcCrEvA@mail.gmail.com>
	<20240208183835.GA503311@nathanxps13>

Nathan Bossart <nathandbossart@gmail.com> writes:
> On Thu, Feb 08, 2024 at 02:16:11PM +0100, Mats Kindahl wrote:
>> +/*
>> + * Compare two integers and return -1, 0, or 1 without risking overflow.
>> + *
>> + * This macro is used to avoid running into overflow issues because a simple
>> + * subtraction of the two values when implementing a cmp function for qsort().
>> +*/
>> +#define INT_CMP(lhs,rhs) (((lhs) > (rhs)) - ((lhs) < (rhs)))

> I think we should offer a few different macros, i.e., separate macros for
> int8, uint8, int16, uint16, int32, etc.  For int16, we can do something
> faster like

> 	(int32) (lhs) - (int32) (rhs)

> but for int32, we need to do someting more like what's in the patch.

Are we okay with using macros that (a) have double evaluation hazards
and (b) don't enforce the data types being compared are the same?
I think static inlines might be a safer technology.  Perhaps it's
okay given the only expected use is in qsort comparators, but ...

			regards, tom lane





view thread (64+ messages)  latest in thread

Message-ID: <1074897.1707417842@sss.pgh.pa.us>
Permalink:  ../1074897.1707417842@sss.pgh.pa.us/
Also on:    postgresql.org/message-id/1074897.1707417842@sss.pgh.pa.us

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: tgl@sss.pgh.pa.us, nathandbossart@gmail.com, mats@timescale.com, thomas.munro@gmail.com, andres@anarazel.de, hlinnaka@iki.fi, pgsql-hackers@lists.postgresql.org
  Subject: Re: glibc qsort() vulnerability
  In-Reply-To: <1074897.1707417842@sss.pgh.pa.us>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox