MIME-Version: 1.0
References: <CAEudQAp34o_8u6sGSVraLwuMv9F7T9hyHpePXHmRaxR2Aboi+w@mail.gmail.com>
 <ZwWkBb2gxs5fGttK@nathan>
In-Reply-To: <ZwWkBb2gxs5fGttK@nathan>
From: Ranier Vilela <ranier.vf@gmail.com>
Date: Wed, 9 Oct 2024 13:16:31 -0300
Message-ID: <CAEudQAr8KZET1ogPnT7esb7YdYbmJyFZWo-OnP+FgoKeL+N31A@mail.gmail.com>
Subject: Re: Avoid possible overflow (src/port/bsearch_arg.c)
To: Nathan Bossart <nathandbossart@gmail.com>
Cc: Pg Hackers <pgsql-hackers@postgresql.org>
Content-Type: multipart/alternative; boundary="000000000000755ab406240d94a2"
Archived-At: <https://www.postgresql.org/message-id/CAEudQAr8KZET1ogPnT7esb7YdYbmJyFZWo-OnP%2BFgoKeL%2BN31A%40mail.gmail.com>
Precedence: bulk

--000000000000755ab406240d94a2
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Em ter., 8 de out. de 2024 =C3=A0s 18:28, Nathan Bossart <
nathandbossart@gmail.com> escreveu:

> On Tue, Oct 08, 2024 at 04:09:00PM -0300, Ranier Vilela wrote:
> > The port function *bsearch_arg* mimics the C function
> > *bsearch*.
> >
> > The API signature is:
> > void *
> > bsearch_arg(const void *key, const void *base0,
> > size_t nmemb, size_t size,
> > int (*compar) (const void *, const void *, void *),
> > void *arg)
> >
> > So, the parameter *nmemb* is size_t.
> > Therefore, a call with nmemb greater than INT_MAX is possible.
> >
> > Internally the code uses the *int* type to iterate through the number o=
f
> > members, which makes overflow possible.
>
> I traced this back to commit bfa2cee (v14), which both moved bsearch_arg(=
)
> to its current location and adjusted the style a bit.  Your patch looks
> reasonable to me.
>
Thanks for looking.

best regards,
Ranier Vilela

--000000000000755ab406240d94a2
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail=
_attr">Em ter., 8 de out. de 2024 =C3=A0s 18:28, Nathan Bossart &lt;<a href=
=3D"mailto:nathandbossart@gmail.com">nathandbossart@gmail.com</a>&gt; escre=
veu:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px=
 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On Tue, Oct=
 08, 2024 at 04:09:00PM -0300, Ranier Vilela wrote:<br>
&gt; The port function *bsearch_arg* mimics the C function<br>
&gt; *bsearch*.<br>
&gt; <br>
&gt; The API signature is:<br>
&gt; void *<br>
&gt; bsearch_arg(const void *key, const void *base0,<br>
&gt; size_t nmemb, size_t size,<br>
&gt; int (*compar) (const void *, const void *, void *),<br>
&gt; void *arg)<br>
&gt; <br>
&gt; So, the parameter *nmemb* is size_t.<br>
&gt; Therefore, a call with nmemb greater than INT_MAX is possible.<br>
&gt; <br>
&gt; Internally the code uses the *int* type to iterate through the number =
of<br>
&gt; members, which makes overflow possible.<br>
<br>
I traced this back to commit bfa2cee (v14), which both moved bsearch_arg()<=
br>
to its current location and adjusted the style a bit.=C2=A0 Your patch look=
s<br>
reasonable to me.<br></blockquote><div>Thanks for looking.</div><div><br></=
div><div>best regards,</div><div>Ranier Vilela</div></div></div>

--000000000000755ab406240d94a2--