Fix potential pointer overflow in xlogreader.c.
authorThomas Munro <tmunro@postgresql.org>
Fri, 8 Dec 2023 02:10:48 +0000 (15:10 +1300)
committerThomas Munro <tmunro@postgresql.org>
Fri, 8 Dec 2023 03:09:03 +0000 (16:09 +1300)
commitcd7f19da34684b7b12fdc08511c5ce7bebb09419
tree733ab41b46a157ab6d52db25d376b3e0dfc640ad
parent2cc2d02dd04ff01602f25c141d814ab46776ade4
Fix potential pointer overflow in xlogreader.c.

While checking if a record could fit in the circular WAL decoding
buffer, the coding from commit 3f1ce973 used arithmetic that could
overflow.  64 bit systems were unaffected for various technical reasons,
which probably explains the lack of problem reports.  Likewise for 32
bit systems running known 32 bit kernels.  The systems at risk of
problems appear to be 32 bit processes running on 64 bit kernels, with
unlucky placement in memory.

Per complaint from GCC -fsanitize=undefined -m32, while testing
variations of 039_end_of_wal.pl.

Back-patch to 15.

Reviewed-by: Nathan Bossart <nathandbossart@gmail.com>
Reviewed-by: Robert Haas <robertmhaas@gmail.com>
Discussion: https://postgr.es/m/CA%2BhUKGKH0oRPOX7DhiQ_b51sM8HqcPp2J3WA-Oen%3DdXog%2BAGGQ%40mail.gmail.com
src/backend/access/transam/xlogreader.c