summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAndrew Gierth2020-11-12 14:34:37 +0000
committerAndrew Gierth2020-11-12 14:34:37 +0000
commit3836d4b643369310dc2f98ad311baeac307590d7 (patch)
treee8774f570f199f7ec69e8f63cad20d8ec3f2960d
parent9c4f5192f69ed16c99e0d079f0b5faebd7bad212 (diff)
pg_trgm: fix crash in 2-item picksplit
Whether from size overflow in gistSplit or from secondary splits, picksplit is (rarely) called with exactly two items to split. Formerly, due to special-case handling of the last item, this would lead to access to an uninitialized cache entry; prior to PG 13 this might have been harmless or at worst led to an incorrect union datum, but in 13 onwards it can cause a backend crash from using an uninitialized pointer. Repair by removing the special case, which was deemed not to have been appropriate anyway. Backpatch all the way, because this bug has existed since pg_trgm was added. Per report on IRC from user "ftzdomino". Analysis and testing by me, patch from Alexander Korotkov. Discussion: https://postgr.es/m/[email protected]
-rw-r--r--contrib/pg_trgm/trgm_gist.c12
1 files changed, 4 insertions, 8 deletions
diff --git a/contrib/pg_trgm/trgm_gist.c b/contrib/pg_trgm/trgm_gist.c
index 2a06730635..9c0ed6ed73 100644
--- a/contrib/pg_trgm/trgm_gist.c
+++ b/contrib/pg_trgm/trgm_gist.c
@@ -786,7 +786,7 @@ Datum
gtrgm_picksplit(PG_FUNCTION_ARGS)
{
GistEntryVector *entryvec = (GistEntryVector *) PG_GETARG_POINTER(0);
- OffsetNumber maxoff = entryvec->n - 2;
+ OffsetNumber maxoff = entryvec->n - 1;
GIST_SPLITVEC *v = (GIST_SPLITVEC *) PG_GETARG_POINTER(1);
int siglen = GET_SIGLEN();
OffsetNumber k,
@@ -811,8 +811,8 @@ gtrgm_picksplit(PG_FUNCTION_ARGS)
SPLITCOST *costvector;
/* cache the sign data for each existing item */
- cache = (CACHESIGN *) palloc(sizeof(CACHESIGN) * (maxoff + 2));
- cache_sign = palloc(siglen * (maxoff + 2));
+ cache = (CACHESIGN *) palloc(sizeof(CACHESIGN) * (maxoff + 1));
+ cache_sign = palloc(siglen * (maxoff + 1));
for (k = FirstOffsetNumber; k <= maxoff; k = OffsetNumberNext(k))
fillcache(&cache[k], GETENTRY(entryvec, k), &cache_sign[siglen * k],
@@ -841,7 +841,7 @@ gtrgm_picksplit(PG_FUNCTION_ARGS)
}
/* initialize the result vectors */
- nbytes = (maxoff + 2) * sizeof(OffsetNumber);
+ nbytes = maxoff * sizeof(OffsetNumber);
v->spl_left = left = (OffsetNumber *) palloc(nbytes);
v->spl_right = right = (OffsetNumber *) palloc(nbytes);
v->spl_nleft = 0;
@@ -853,9 +853,6 @@ gtrgm_picksplit(PG_FUNCTION_ARGS)
union_l = GETSIGN(datum_l);
union_r = GETSIGN(datum_r);
- maxoff = OffsetNumberNext(maxoff);
- fillcache(&cache[maxoff], GETENTRY(entryvec, maxoff),
- &cache_sign[siglen * maxoff], siglen);
/* sort before ... */
costvector = (SPLITCOST *) palloc(sizeof(SPLITCOST) * maxoff);
@@ -944,7 +941,6 @@ gtrgm_picksplit(PG_FUNCTION_ARGS)
}
}
- *right = *left = FirstOffsetNumber;
v->spl_ldatum = PointerGetDatum(datum_l);
v->spl_rdatum = PointerGetDatum(datum_r);