[PATCH] pg_surgery: check the page header and line pointers

[shihao zhong]

Hi hackers.

heap_force_kill() and heap_force_freeze() index a stack array,
include_this_tid[MaxHeapTuplesPerPage], using PageGetMaxOffsetNumber().

That comes from pd_lower, so a page with pd_lower, pd_upper and
pd_special all 8192 passes PageIsVerified() but has max offset
(8192 - 24) / 4. The array is then read past its end and the backend
crashes.

  ERROR: AddressSanitizer: stack-buffer-overflow READ at heap_surgery.c:256
    [32, 323) 'include_this_tid' <== overflows

Superuser and owner only, so not a security issue.

Thanks,
Shihao

0001-pg_surgery-bound-the-page-s-max-offset-by-MaxHeapTup.patch
Description: Binary data