Subject: Re: UBSan pointer overflow in xlogreader.c

From: Robert Haas <[email-masked]>
Date: Tue, 5 Dec 2023 15:48:33 -0500

On Tue, Dec 5, 2023 at 1:04 PM Nathan Bossart <[email-masked]> wrote:
> On Wed, Dec 06, 2023 at 12:03:53AM +1300, Thomas Munro wrote:
> > xlogreader.c has a pointer overflow bug, as revealed by the
> > combination of -fsanitize=undefined -m32, the new 039_end_of_wal.pl
> > test and Robert's incremental backup patch[1].  The bad code tests
> > whether an object could fit using something like base + size <= end,
> > which can be converted to something like size <= end - base to avoid
> > the overflow.  See experimental fix patch, attached.
>
> The patch LGTM.  I wonder if it might be worth creating some special
> pointer arithmetic routines (perhaps using the stuff in common/int.h) to
> help prevent this sort of thing in the future.  But that'd require you to
> realize that your code is at risk of overflow, at which point it's probably
> just as easy to restructure the logic like you've done here.

The patch LGTM, too. Thanks for investigating and writing the code.
The part about how the reserved kernel memory prevents the bug from
appearing on 32-bit systems but not 64-bit systems running in 32-bit
mode is pretty interesting -- I don't want to think about how long it
would have taken me to figure that out.

-- 
Robert Haas
EDB: http://www.enterprisedb.com

---

From: Nathan Bossart <[email-masked]>
Date: Tue, 5 Dec 2023 15:01:41 -0600

> would have taken me to figure that out.

+1

-- 
Nathan Bossart
Amazon Web Services: https://aws.amazon.com

---

From: Robert Haas <[email-masked]>
Date: Thu, 7 Dec 2023 09:57:32 -0500

So, Thomas ... any chance you could commit this? So that my patch
stops making cfbot sad?

---

From: Thomas Munro <[email-masked]>
Date: Fri, 8 Dec 2023 16:17:47 +1300

> So, Thomas ... any chance you could commit this? So that my patch

Done.  Thanks both for the reviews.

---

From: Robert Haas <[email-masked]>
Date: Fri, 8 Dec 2023 11:29:03 -0500

> Done.  Thanks both for the reviews.

Thank you!