MIME-Version: 1.0
From: Ranier Vilela <ranier.vf@gmail.com>
Date: Tue, 8 Oct 2024 16:09:00 -0300
Message-ID: <CAEudQAp34o_8u6sGSVraLwuMv9F7T9hyHpePXHmRaxR2Aboi+w@mail.gmail.com>
Subject: Avoid possible overflow (src/port/bsearch_arg.c)
To: Pg Hackers <pgsql-hackers@postgresql.org>
Content-Type: multipart/mixed; boundary="00000000000072ef1c0623fbdf4c"
Archived-At: <https://www.postgresql.org/message-id/CAEudQAp34o_8u6sGSVraLwuMv9F7T9hyHpePXHmRaxR2Aboi%2Bw%40mail.gmail.com>
Precedence: bulk

--00000000000072ef1c0623fbdf4c
Content-Type: multipart/alternative; boundary="00000000000072ef1b0623fbdf4a"

--00000000000072ef1b0623fbdf4a
Content-Type: text/plain; charset="UTF-8"

Hi.

The port function *bsearch_arg* mimics the C function
*bsearch*.

The API signature is:
void *
bsearch_arg(const void *key, const void *base0,
size_t nmemb, size_t size,
int (*compar) (const void *, const void *, void *),
void *arg)

So, the parameter *nmemb* is size_t.
Therefore, a call with nmemb greater than INT_MAX is possible.

Internally the code uses the *int* type to iterate through the number of
members, which makes overflow possible.

Trivial fix attached.

best regards,
Ranier Vilela

--00000000000072ef1b0623fbdf4a
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hi.</div><div><br></div><div>The port function *bsear=
ch_arg* mimics the C function</div><div>*bsearch*.</div><div><br></div><div=
>The API signature is:</div><div>void *<br>bsearch_arg(const void *key, con=
st void *base0,<br>			size_t nmemb, size_t size,<br>			int (*compar) (const=
 void *, const void *, void *),<br>			void *arg)</div><div><br></div><div>S=
o, the parameter *nmemb* is size_t.</div><div>Therefore, a call with nmemb =
greater than INT_MAX is possible.</div><div><br></div><div>Internally the c=
ode uses the *int* type to iterate through the number of members, which mak=
es overflow possible.</div><div><br></div><div>Trivial fix attached.</div><=
div><br></div><div>best regards,</div><div>Ranier Vilela<br></div></div>

--00000000000072ef1b0623fbdf4a--
--00000000000072ef1c0623fbdf4c
Content-Type: application/octet-stream; 
	name="avoid-possible-overflow-bsearch_arg.patch"
Content-Disposition: attachment; 
	filename="avoid-possible-overflow-bsearch_arg.patch"
Content-Transfer-Encoding: base64
Content-ID: <f_m20t84jp0>
X-Attachment-Id: f_m20t84jp0

ZGlmZiAtLWdpdCBhL3NyYy9wb3J0L2JzZWFyY2hfYXJnLmMgYi9zcmMvcG9ydC9ic2VhcmNoX2Fy
Zy5jCmluZGV4IGYwZGU0NjdiZWUuLmUwNDQ2YTlmMDcgMTAwNjQ0Ci0tLSBhL3NyYy9wb3J0L2Jz
ZWFyY2hfYXJnLmMKKysrIGIvc3JjL3BvcnQvYnNlYXJjaF9hcmcuYwpAQCAtNTgsOCArNTgsOCBA
QCBic2VhcmNoX2FyZyhjb25zdCB2b2lkICprZXksIGNvbnN0IHZvaWQgKmJhc2UwLAogCQkJdm9p
ZCAqYXJnKQogewogCWNvbnN0IGNoYXIgKmJhc2UgPSAoY29uc3QgY2hhciAqKSBiYXNlMDsKLQlp
bnQJCQlsaW0sCi0JCQkJY21wOworCXNpemVfdAkJbGltOworCWludAkJCWNtcDsKIAljb25zdCB2
b2lkICpwOwogCiAJZm9yIChsaW0gPSBubWVtYjsgbGltICE9IDA7IGxpbSA+Pj0gMSkK
--00000000000072ef1c0623fbdf4c--