upstream/postgresql
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2026-03-12 21:54:00 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions
postgresql/src/include/utils
History
Tom Lane 0c1caa48d3 Prevent integer overflows in array subscripting calculations. 
While we were (mostly) careful about ensuring that the dimensions of
arrays aren't large enough to cause integer overflow, the lower bound
values were generally not checked.  This allows situations where
lower_bound + dimension overflows an integer.  It seems that that's
harmless so far as array reading is concerned, except that array
elements with subscripts notionally exceeding INT_MAX are inaccessible.
However, it confuses various array-assignment logic, resulting in a
potential for memory stomps.

Fix by adding checks that array lower bounds aren't large enough to
cause lower_bound + dimension to overflow.  (Note: this results in
disallowing cases where the last subscript position would be exactly
INT_MAX.  In principle we could probably allow that, but there's a lot
of code that computes lower_bound + dimension and would need adjustment.
It seems doubtful that it's worth the trouble/risk to allow it.)

Somewhat independently of that, array_set_element() was careless
about possible overflow when checking the subscript of a fixed-length
array, creating a different route to memory stomps.  Fix that too.

Security: CVE-2021-32027
2021-05-10 10:44:38 -04:00
..
.gitignore Avoid maintaining three separate copies of the error codes list. 2011-02-03 22:32:49 -05:00
acl.h Fix missing role dependencies for some schema and type ACLs. 2018-11-09 20:42:03 -05:00
aclchk_internal.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
array.h Prevent integer overflows in array subscripting calculations. 2021-05-10 10:44:38 -04:00
arrayaccess.h Don't read fields of a misaligned ExpandedObjectHeader or AnyArrayType. 2019-06-30 17:34:20 -07:00
ascii.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
attoptcache.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
builtins.h Further fixes for quoted-list GUC values in pg_dump and ruleutils.c. 2018-07-31 13:00:08 -04:00
bytea.h Extend sortsupport for text to more opclasses. 2016-02-03 14:29:53 -05:00
cash.h Add casts from int4 and int8 to numeric. 2011-04-05 09:35:43 -04:00
catcache.h Remove AtEOXact_CatCache(). 2017-08-13 16:15:14 -04:00
combocid.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
date.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
datetime.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
datum.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
dynahash.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
dynamic_loader.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
elog.h Improve unreachability recognition in elog() macro. 2016-09-10 17:54:23 -04:00
evtcache.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
expandeddatum.h Don't read fields of a misaligned ExpandedObjectHeader or AnyArrayType. 2019-06-30 17:34:20 -07:00
fmgrtab.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
formatting.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
geo_decls.h pgindent run for 9.6 2016-06-09 18:02:36 -04:00
guc.h Fix mishandling of quoted-list GUC values in pg_dump and ruleutils.c. 2018-03-21 20:03:28 -04:00
guc_tables.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
help_config.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
hsearch.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
index_selfuncs.h Restructure index access method API to hide most of it at the C level. 2016-01-17 19:36:59 -05:00
inet.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
int8.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
inval.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
json.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
jsonapi.h pgindent run for 9.6 2016-06-09 18:02:36 -04:00
jsonb.h pgindent run for 9.6 2016-06-09 18:02:36 -04:00
logtape.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
lsyscache.h Preserve clustered index after rewrites with ALTER TABLE 2020-04-06 11:06:04 +09:00
memdebug.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
memutils.h Ensure SIZE_MAX can be used throughout our code. 2017-09-01 13:52:53 -04:00
nabstime.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
numeric.h Remove bogus dependencies on NUMERIC_MAX_PRECISION. 2016-08-14 15:06:01 -04:00
palloc.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
pg_crc.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
pg_locale.h Cope if platform declares mbstowcs_l(), but not locale_t, in <xlocale.h>. 2016-03-15 13:19:57 -04:00
pg_lsn.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
pg_rusage.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
plancache.h Avoid invalidating all foreign-join cached plans when user mappings change. 2016-07-15 17:23:02 -04:00
portal.h Fix TOAST access failure in RETURNING queries. 2016-08-07 17:46:08 -04:00
ps_status.h Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
rangetypes.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
rel.h Revert "Skip WAL for new relfilenodes, under wal_level=minimal." 2020-03-22 09:24:15 -07:00
relcache.h Revert "Skip WAL for new relfilenodes, under wal_level=minimal." 2020-03-22 09:24:15 -07:00
relfilenodemap.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
relmapper.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
reltrigger.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
resowner.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
resowner_private.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
rls.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
ruleutils.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
sampling.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
selfuncs.h Add security checks to selectivity estimation functions 2017-05-08 09:18:57 -04:00
snapmgr.h Mark assorted variables PGDLLIMPORT. 2017-12-05 09:27:20 -05:00
snapshot.h Add the "snapshot too old" feature 2016-04-08 14:36:30 -05:00
sortsupport.h Allow btree comparison functions to return INT_MIN. 2018-10-05 16:01:30 -04:00
spccache.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
syscache.h Avoid searching for callback functions in CallSyscacheCallbacks(). 2017-05-12 19:05:28 -04:00
timeout.h Be more predictable about reporting "lock timeout" vs "statement timeout". 2016-05-27 10:40:20 -04:00
timestamp.h Fix and simplify some usages of TimestampDifference(). 2020-11-10 22:51:57 -05:00
tqual.h Fix low-probability loss of NOTIFY messages due to XID wraparound. 2017-10-11 14:28:33 -04:00
tuplesort.h Reuse abbreviated keys in ordered [set] aggregates. 2016-02-17 15:40:00 +05:30
tuplestore.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
typcache.h Fix handling of expanded objects in CoerceToDomain and CASE execution. 2016-12-22 15:01:38 -05:00
tzparser.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
uuid.h Update copyright for 2016 2016-01-02 13:33:40 -05:00
varbit.h Fix failure to zero-pad the result of bitshiftright(). 2019-09-22 17:46:00 -04:00
xml.h Update copyright for 2016 2016-01-02 13:33:40 -05:00