MIME-Version: 1.0
From: Ranier Vilela <ranier.vf@gmail.com>
Date: Sun, 14 Apr 2024 20:17:35 -0300
Message-ID: <CAEudQAoY0xrKuTAX7W10zsjjUpKBPFRtdCyScb3Z0FB2v6HNmQ@mail.gmail.com>
Subject: Fix out-of-bounds in the function GetCommandTagName
To: Pg Hackers <pgsql-hackers@postgresql.org>
Content-Type: multipart/alternative; boundary="0000000000007745f0061616b649"
Archived-At: <https://www.postgresql.org/message-id/CAEudQAoY0xrKuTAX7W10zsjjUpKBPFRtdCyScb3Z0FB2v6HNmQ%40mail.gmail.com>
Precedence: bulk

--0000000000007745f0061616b649
Content-Type: text/plain; charset="UTF-8"

Hi,

Per Coverity.

Coverity has reported some out-of-bounds bugs
related to the GetCommandTagName function.

CID 1542964: (#1 of 1): Out-of-bounds access (OVERRUN)
7. overrun-call: Overrunning callee's array of size 193 by passing argument
commandtag (which evaluates to 193) in call to GetCommandTagName.[

It turns out that the root of the problem is found in the declaration of
the tag_behavior array, which is found in src/backend/tcop/cmdtag.c.

The size of the array is defined by COMMAND_TAG_NEXTTAG enum,
whose value currently corresponds to 193.
Since enum items are evaluated starting at zero, by default.

It turns out that the final size of the array, 193, limits the number of
items to 192, which excludes the last TAG
PG_CMDTAG(CMDTAG_VACUUM, "VACUUM", false, false, false)

Fixed leaving it up to the compiler to determine the final size of the
array.

Patch attached.

best regards,
Ranier Vilela

--0000000000007745f0061616b649
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hi,</div><div><br></div><div>Per Coverity.</div><div>=
<br></div><div>Coverity has reported some out-of-bounds bugs</div><div>rela=
ted to the GetCommandTagName function.</div><div>
<div><span><div>

<span class=3D"gmail-defect-text"><br></span></div><div><span class=3D"gmai=
l-defect-text">CID 1542964: (#1 of 1): Out-of-bounds access (OVERRUN)
</span></div><span class=3D"event-order">7.</span>
    <span class=3D"event-tag">overrun-call:</span>
    <span class=3D"gmail-description">Overrunning callee&#39;s array of siz=
e 193 by passing argument commandtag (which evaluates to 193) in call to Ge=
tCommandTagName.[</span></span> <br></div><div></div>

</div><div><br></div><div>It turns out that the root of the problem is foun=
d in the declaration of the tag_behavior array, which is found in src/backe=
nd/tcop/cmdtag.c.</div><div><br></div><div>The size of the array is defined=
 by COMMAND_TAG_NEXTTAG enum,</div><div>whose value currently corresponds t=
o 193.</div><div>Since enum items are evaluated starting at zero, by defaul=
t.</div><div><br></div><div>It turns out that the final size of the array, =
193, limits the number of items to 192, which excludes the last TAG<br>PG_C=
MDTAG(CMDTAG_VACUUM, &quot;VACUUM&quot;, false, false, false)</div><div><br=
></div><div>Fixed leaving it up to the compiler to determine the final size=
 of the array.</div><div><br></div><div>Patch attached.</div><div><br></div=
><div>best regards,</div><div>Ranier Vilela<br></div><div><br></div></div>

--0000000000007745f0061616b649--