Content-Type: multipart/mixed; boundary="------------iUNvgwjWmifJHY95Na2ZcUX2"
Message-ID: <796b65c3-57b7-bddf-b0d5-a8afafb8b627@gmail.com>
Date: Tue, 11 Apr 2023 21:19:12 +0530
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.9.0
Content-Language: en-US
From: Ankit Kumar Pandey <itsankitkp@gmail.com>
Subject: [BUG #17888] Incorrect memory access in gist__int_ops for an input
 array with many elements
To: pghackers <pgsql-hackers@lists.postgresql.org>
Archived-At: 
 <https://www.postgresql.org/message-id/796b65c3-57b7-bddf-b0d5-a8afafb8b627%40gmail.com>
Precedence: bulk

This is a multi-part message in MIME format.
--------------iUNvgwjWmifJHY95Na2ZcUX2
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

Hi,

I was looking at this issue: 
https://www.postgresql.org/message-id/flat/17888-f72930e6b5ce8c14%40postgresql.org

pfree call on contrib/intarray/_int_gist.c:345

```

     if (in != (ArrayType *) DatumGetPointer(entry->key))
         pfree(in);

```

leads to BogusFree function call and server crash.

This is when we use array size of 1001.

If we increase array size to 3001, we get index size error,

NOTICE:  input array is too big (199 maximum allowed, 3001 current), use 
gist__intbig_ops opclass instead
ERROR:  index row requires 12040 bytes, maximum size is 8191

When array size is 1001 is concerned, we raise elog about input array is 
too big, multiple of times. Wouldn't it make more sense to error out 
instead of proceeding further and getting bogus pointer errors messages 
(as we do when size is 3001)?

Changing elog to ereport makes behavior consistent (between array size 
of 1001 vs 3001), so I have

attached a patch for that.

It errors out like this:

ERROR:  input array is too big (199 maximum allowed, 1001 current), use 
gist__intbig_ops opclass instead

This is same error which was raised as notice earlier.

Let me know if it makes sense.


Also, comments on BogusFree mentions `As a possible
aid in debugging, we report the header word along with the pointer
address`. How can we interpret useful debugging information from this?

`pfree called with invalid pointer 0x7ff1706d0030 (header 
0x4fc8000100000000)`


Regards,

Ankit

--------------iUNvgwjWmifJHY95Na2ZcUX2
Content-Type: text/x-patch; charset=UTF-8;
 name="v1-gist-int-ops-overflow.patch"
Content-Disposition: attachment; filename="v1-gist-int-ops-overflow.patch"
Content-Transfer-Encoding: base64

ZGlmZiAtLWdpdCBhL2NvbnRyaWIvaW50YXJyYXkvX2ludF9naXN0LmMgYi9jb250cmliL2lu
dGFycmF5L19pbnRfZ2lzdC5jCmluZGV4IDdhNDhjZTYyNGQuLjc5YzgxMTI3ZjYgMTAwNjQ0
Ci0tLSBhL2NvbnRyaWIvaW50YXJyYXkvX2ludF9naXN0LmMKKysrIGIvY29udHJpYi9pbnRh
cnJheS9faW50X2dpc3QuYwpAQCAtMTgxLDggKzE4MSwxMCBAQCBnX2ludF9jb21wcmVzcyhQ
R19GVU5DVElPTl9BUkdTKQogCQlQUkVQQVJFQVJSKHIpOwogCiAJCWlmIChBUlJORUxFTVMo
cikgPj0gMiAqIG51bV9yYW5nZXMpCi0JCQllbG9nKE5PVElDRSwgImlucHV0IGFycmF5IGlz
IHRvbyBiaWcgKCVkIG1heGltdW0gYWxsb3dlZCwgJWQgY3VycmVudCksIHVzZSBnaXN0X19p
bnRiaWdfb3BzIG9wY2xhc3MgaW5zdGVhZCIsCi0JCQkJIDIgKiBudW1fcmFuZ2VzIC0gMSwg
QVJSTkVMRU1TKHIpKTsKKwkJCWVyZXBvcnQoRVJST1IsCisJCQkJKGVycmNvZGUoRVJSQ09E
RV9QUk9HUkFNX0xJTUlUX0VYQ0VFREVEKSwKKwkJCQkgZXJybXNnKCJpbnB1dCBhcnJheSBp
cyB0b28gYmlnICglZCBtYXhpbXVtIGFsbG93ZWQsICVkIGN1cnJlbnQpLCB1c2UgZ2lzdF9f
aW50YmlnX29wcyBvcGNsYXNzIGluc3RlYWQiLAorCQkJCSAyICogbnVtX3JhbmdlcyAtIDEs
IEFSUk5FTEVNUyhyKSkpKTsKIAogCQlyZXR2YWwgPSBwYWxsb2Moc2l6ZW9mKEdJU1RFTlRS
WSkpOwogCQlnaXN0ZW50cnlpbml0KCpyZXR2YWwsIFBvaW50ZXJHZXREYXR1bShyKSwK

--------------iUNvgwjWmifJHY95Na2ZcUX2--