MIME-Version: 1.0
From: Xing Guo <higuoxing@gmail.com>
Date: Thu, 9 Apr 2026 13:13:59 +0800
Message-ID: 
 <CACpMh+BxvqwPr6DqOGz_gLWWSPX+EgVLiOwMpqg5e71uvszdbA@mail.gmail.com>
Subject: [PATCH] Use mul_size for allocation products potentially to overflow
To: pgsql-hackers@lists.postgresql.org
Content-Type: multipart/mixed; boundary="000000000000370016064f001660"
Archived-At: 
 <https://www.postgresql.org/message-id/CACpMh%2BBxvqwPr6DqOGz_gLWWSPX%2BEgVLiOwMpqg5e71uvszdbA%40mail.gmail.com>
Precedence: bulk

--000000000000370016064f001660
Content-Type: text/plain; charset="UTF-8"

Hi hackers,

I spotted several call sites multiplying runtime variables in palloc
and they can potentially lead
to overflow. I fixed them with mul_size() in backend codes and
pg_mul_size_overflow() in frontend codes.

Best Regards,
Xing

--000000000000370016064f001660
Content-Type: application/octet-stream;
	name="0001-Use-mul_size-for-allocation-products-potentially-to-.patch"
Content-Disposition: attachment;
	filename="0001-Use-mul_size-for-allocation-products-potentially-to-.patch"
Content-Transfer-Encoding: base64
Content-ID: <f_mnr0qimd0>
X-Attachment-Id: f_mnr0qimd0

RnJvbSBlNThjYzI2NGUzMmJmY2Y5Njg4NDdlM2VlYzY4ZDA3ZmNjMTcwMzkwIE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiBYaW5nIEd1byA8aGlndW94aW5nQGdtYWlsLmNvbT4KRGF0ZTog
VGh1LCA5IEFwciAyMDI2IDExOjAwOjU0ICswODAwClN1YmplY3Q6IFtQQVRDSF0gVXNlIG11bF9z
aXplIGZvciBhbGxvY2F0aW9uIHByb2R1Y3RzIHBvdGVudGlhbGx5IHRvIG92ZXJmbG93CgpTZXZl
cmFsIGNhbGwgc2l0ZXMgbXVsdGlwbGllZCBydW50aW1lIGZhY3RvcnMgYmVmb3JlIHBhbGxvYzsg
dXNlIG11bF9zaXplKCkKaW4gdGhlIGJhY2tlbmQgYW5kIHBnX211bF9zaXplX292ZXJmbG93KCkg
aW4gdGhlIGZyb250ZW5kIGd6aXAgYWxsb2NhdG9yLgotLS0KIHNyYy9iYWNrZW5kL2JhY2t1cC9i
YXNlYmFja3VwX2d6aXAuYyB8IDMgKystCiBzcmMvYmFja2VuZC9jYXRhbG9nL25hbWVzcGFjZS5j
ICAgICAgfCAzICsrLQogc3JjL2JhY2tlbmQvc3RvcmFnZS9idWZmZXIvYnVmbWdyLmMgIHwgNCAr
KystCiBzcmMvYmFja2VuZC91dGlscy9hZHQvdHNnaXN0aWR4LmMgICAgfCA3ICsrKystLS0KIHNy
Yy9mZV91dGlscy9hc3RyZWFtZXJfZ3ppcC5jICAgICAgICB8IDggKysrKysrKy0KIDUgZmlsZXMg
Y2hhbmdlZCwgMTggaW5zZXJ0aW9ucygrKSwgNyBkZWxldGlvbnMoLSkKCmRpZmYgLS1naXQgYS9z
cmMvYmFja2VuZC9iYWNrdXAvYmFzZWJhY2t1cF9nemlwLmMgYi9zcmMvYmFja2VuZC9iYWNrdXAv
YmFzZWJhY2t1cF9nemlwLmMKaW5kZXggYzVlNGM0MTQzZTguLjFlYzJjMTNlYTdmIDEwMDY0NAot
LS0gYS9zcmMvYmFja2VuZC9iYWNrdXAvYmFzZWJhY2t1cF9nemlwLmMKKysrIGIvc3JjL2JhY2tl
bmQvYmFja3VwL2Jhc2ViYWNrdXBfZ3ppcC5jCkBAIC0xNyw2ICsxNyw3IEBACiAjZW5kaWYKIAog
I2luY2x1ZGUgImJhY2t1cC9iYXNlYmFja3VwX3NpbmsuaCIKKyNpbmNsdWRlICJzdG9yYWdlL3No
bWVtLmgiCiAKICNpZmRlZiBIQVZFX0xJQloKIHR5cGVkZWYgc3RydWN0IGJic2lua19nemlwCkBA
IC0yOTcsNyArMjk4LDcgQEAgYmJzaW5rX2d6aXBfbWFuaWZlc3RfY29udGVudHMoYmJzaW5rICpz
aW5rLCBzaXplX3QgbGVuKQogc3RhdGljIHZvaWQgKgogZ3ppcF9wYWxsb2Modm9pZCAqb3BhcXVl
LCB1bnNpZ25lZCBpdGVtcywgdW5zaWduZWQgc2l6ZSkKIHsKLQlyZXR1cm4gcGFsbG9jKGl0ZW1z
ICogc2l6ZSk7CisJcmV0dXJuIHBhbGxvYyhtdWxfc2l6ZShzaXplLCBpdGVtcykpOwogfQogCiAv
KgpkaWZmIC0tZ2l0IGEvc3JjL2JhY2tlbmQvY2F0YWxvZy9uYW1lc3BhY2UuYyBiL3NyYy9iYWNr
ZW5kL2NhdGFsb2cvbmFtZXNwYWNlLmMKaW5kZXggNTZiODdkODc4ZTguLmQyNTFjZDMwMmZmIDEw
MDY0NAotLS0gYS9zcmMvYmFja2VuZC9jYXRhbG9nL25hbWVzcGFjZS5jCisrKyBiL3NyYy9iYWNr
ZW5kL2NhdGFsb2cvbmFtZXNwYWNlLmMKQEAgLTQ4LDYgKzQ4LDcgQEAKICNpbmNsdWRlICJub2Rl
cy9tYWtlZnVuY3MuaCIKICNpbmNsdWRlICJzdG9yYWdlL2lwYy5oIgogI2luY2x1ZGUgInN0b3Jh
Z2UvbG1nci5oIgorI2luY2x1ZGUgInN0b3JhZ2Uvc2htZW0uaCIKICNpbmNsdWRlICJzdG9yYWdl
L3Byb2MuaCIKICNpbmNsdWRlICJzdG9yYWdlL3Byb2NhcnJheS5oIgogI2luY2x1ZGUgInV0aWxz
L2FjbC5oIgpAQCAtMTk5NCw3ICsxOTk1LDcgQEAgT3Blcm5hbWVHZXRDYW5kaWRhdGVzKExpc3Qg
Km5hbWVzLCBjaGFyIG9wcmtpbmQsIGJvb2wgbWlzc2luZ19zY2hlbWFfb2ssCiAJCQkJCQkJICAy
ICogc2l6ZW9mKE9pZCkpCiAKIAlpZiAoY2F0bGlzdC0+bl9tZW1iZXJzID4gMCkKLQkJcmVzdWx0
U3BhY2UgPSBwYWxsb2MoY2F0bGlzdC0+bl9tZW1iZXJzICogU1BBQ0VfUEVSX09QKTsKKwkJcmVz
dWx0U3BhY2UgPSBwYWxsb2MobXVsX3NpemUoU1BBQ0VfUEVSX09QLCBjYXRsaXN0LT5uX21lbWJl
cnMpKTsKIAogCWZvciAoaSA9IDA7IGkgPCBjYXRsaXN0LT5uX21lbWJlcnM7IGkrKykKIAl7CmRp
ZmYgLS1naXQgYS9zcmMvYmFja2VuZC9zdG9yYWdlL2J1ZmZlci9idWZtZ3IuYyBiL3NyYy9iYWNr
ZW5kL3N0b3JhZ2UvYnVmZmVyL2J1Zm1nci5jCmluZGV4IDNjYzBiMGJkZDkyLi5iNzM4YzA1Mzgz
MCAxMDA2NDQKLS0tIGEvc3JjL2JhY2tlbmQvc3RvcmFnZS9idWZmZXIvYnVmbWdyLmMKKysrIGIv
c3JjL2JhY2tlbmQvc3RvcmFnZS9idWZmZXIvYnVmbWdyLmMKQEAgLTYyLDYgKzYyLDcgQEAKICNp
bmNsdWRlICJzdG9yYWdlL3Byb2NsaXN0LmgiCiAjaW5jbHVkZSAic3RvcmFnZS9wcm9jc2lnbmFs
LmgiCiAjaW5jbHVkZSAic3RvcmFnZS9yZWFkX3N0cmVhbS5oIgorI2luY2x1ZGUgInN0b3JhZ2Uv
c2htZW0uaCIKICNpbmNsdWRlICJzdG9yYWdlL3NtZ3IuaCIKICNpbmNsdWRlICJzdG9yYWdlL3N0
YW5kYnkuaCIKICNpbmNsdWRlICJ1dGlscy9tZW1kZWJ1Zy5oIgpAQCAtNDkyNSw3ICs0OTI2LDgg
QEAgRHJvcFJlbGF0aW9uc0FsbEJ1ZmZlcnMoU01nclJlbGF0aW9uICpzbWdyX3JlbG4sIGludCBu
bG9jYXRvcnMpCiAJICogZm9ya3MuCiAJICovCiAJYmxvY2sgPSAoQmxvY2tOdW1iZXIgKCopW01B
WF9GT1JLTlVNICsgMV0pCi0JCXBhbGxvYyhzaXplb2YoQmxvY2tOdW1iZXIpICogbiAqIChNQVhf
Rk9SS05VTSArIDEpKTsKKwkJcGFsbG9jKG11bF9zaXplKG11bF9zaXplKHNpemVvZihCbG9ja051
bWJlciksIChNQVhfRk9SS05VTSArIDEpKSwKKwkJCQkJCW4pKTsKIAogCS8qCiAJICogV2UgY2Fu
IGF2b2lkIHNjYW5uaW5nIHRoZSBlbnRpcmUgYnVmZmVyIHBvb2wgaWYgd2Uga25vdyB0aGUgZXhh
Y3Qgc2l6ZQpkaWZmIC0tZ2l0IGEvc3JjL2JhY2tlbmQvdXRpbHMvYWR0L3RzZ2lzdGlkeC5jIGIv
c3JjL2JhY2tlbmQvdXRpbHMvYWR0L3RzZ2lzdGlkeC5jCmluZGV4IGUzNWEyNTc5N2EwLi4zOGE4
MGFkNzJkMiAxMDA2NDQKLS0tIGEvc3JjL2JhY2tlbmQvdXRpbHMvYWR0L3RzZ2lzdGlkeC5jCisr
KyBiL3NyYy9iYWNrZW5kL3V0aWxzL2FkdC90c2dpc3RpZHguYwpAQCAtMTgsNiArMTgsNyBAQAog
I2luY2x1ZGUgImFjY2Vzcy9oZWFwdG9hc3QuaCIKICNpbmNsdWRlICJhY2Nlc3MvcmVsb3B0aW9u
cy5oIgogI2luY2x1ZGUgImNvbW1vbi9pbnQuaCIKKyNpbmNsdWRlICJzdG9yYWdlL3NobWVtLmgi
CiAjaW5jbHVkZSAibGliL3F1bmlxdWUuaCIKICNpbmNsdWRlICJwb3J0L3BnX2JpdHV0aWxzLmgi
CiAjaW5jbHVkZSAidHNlYXJjaC90c191dGlscy5oIgpAQCAtNjI1LDcgKzYyNiw3IEBAIGd0c3Zl
Y3Rvcl9waWNrc3BsaXQoUEdfRlVOQ1RJT05fQVJHUykKIAkJCQlzaXplX2JldGE7CiAJaW50MzIJ
CXNpemVfd2FzdGUsCiAJCQkJd2FzdGUgPSAtMTsKLQlpbnQzMgkJbmJ5dGVzOworCVNpemUJCW5i
eXRlczsKIAlPZmZzZXROdW1iZXIgc2VlZF8xID0gMCwKIAkJCQlzZWVkXzIgPSAwOwogCU9mZnNl
dE51bWJlciAqbGVmdCwKQEAgLTYzOCwxMiArNjM5LDEyIEBAIGd0c3ZlY3Rvcl9waWNrc3BsaXQo
UEdfRlVOQ1RJT05fQVJHUykKIAlTUExJVENPU1QgICpjb3N0dmVjdG9yOwogCiAJbWF4b2ZmID0g
ZW50cnl2ZWMtPm4gLSAyOwotCW5ieXRlcyA9IChtYXhvZmYgKyAyKSAqIHNpemVvZihPZmZzZXRO
dW1iZXIpOworCW5ieXRlcyA9IG11bF9zaXplKHNpemVvZihPZmZzZXROdW1iZXIpLCAobWF4b2Zm
ICsgMikpOwogCXYtPnNwbF9sZWZ0ID0gKE9mZnNldE51bWJlciAqKSBwYWxsb2MobmJ5dGVzKTsK
IAl2LT5zcGxfcmlnaHQgPSAoT2Zmc2V0TnVtYmVyICopIHBhbGxvYyhuYnl0ZXMpOwogCiAJY2Fj
aGUgPSBwYWxsb2NfYXJyYXkoQ0FDSEVTSUdOLCBtYXhvZmYgKyAyKTsKLQljYWNoZV9zaWduID0g
cGFsbG9jKHNpZ2xlbiAqIChtYXhvZmYgKyAyKSk7CisJY2FjaGVfc2lnbiA9IHBhbGxvYyhtdWxf
c2l6ZShzaWdsZW4sIChtYXhvZmYgKyAyKSkpOwogCiAJZm9yIChqID0gMDsgaiA8IG1heG9mZiAr
IDI7IGorKykKIAkJY2FjaGVbal0uc2lnbiA9ICZjYWNoZV9zaWduW3NpZ2xlbiAqIGpdOwpkaWZm
IC0tZ2l0IGEvc3JjL2ZlX3V0aWxzL2FzdHJlYW1lcl9nemlwLmMgYi9zcmMvZmVfdXRpbHMvYXN0
cmVhbWVyX2d6aXAuYwppbmRleCBiYzNkNTMwNzZlMS4uZmZjNDFhNzUyMTkgMTAwNjQ0Ci0tLSBh
L3NyYy9mZV91dGlscy9hc3RyZWFtZXJfZ3ppcC5jCisrKyBiL3NyYy9mZV91dGlscy9hc3RyZWFt
ZXJfZ3ppcC5jCkBAIC0zMiw2ICszMiw3IEBACiAjaW5jbHVkZSA8emxpYi5oPgogI2VuZGlmCiAK
KyNpbmNsdWRlICJjb21tb24vaW50LmgiCiAjaW5jbHVkZSAiY29tbW9uL2xvZ2dpbmcuaCIKICNp
bmNsdWRlICJmZV91dGlscy9hc3RyZWFtZXIuaCIKIApAQCAtMzgyLDcgKzM4MywxMiBAQCBhc3Ry
ZWFtZXJfZ3ppcF9kZWNvbXByZXNzb3JfZnJlZShhc3RyZWFtZXIgKnN0cmVhbWVyKQogc3RhdGlj
IHZvaWQgKgogZ3ppcF9wYWxsb2Modm9pZCAqb3BhcXVlLCB1bnNpZ25lZCBpdGVtcywgdW5zaWdu
ZWQgc2l6ZSkKIHsKLQlyZXR1cm4gcGFsbG9jKGl0ZW1zICogc2l6ZSk7CisJc2l6ZV90IG5ieXRl
czsKKworCWlmIChwZ19tdWxfc2l6ZV9vdmVyZmxvdygoc2l6ZV90KSBzaXplLCAoc2l6ZV90KSBp
dGVtcywgJm5ieXRlcykpCisJCXBnX2ZhdGFsKCJnemlwIGxpYnJhcnkgcmVxdWVzdGVkIGludmFs
aWQgYWxsb2NhdGlvbiBzaXplIik7CisKKwlyZXR1cm4gcGFsbG9jKG5ieXRlcyk7CiB9CiAKIC8q
Ci0tIAoyLjUwLjEgKEFwcGxlIEdpdC0xNTUpCgo=
--000000000000370016064f001660--