On Wed, Jun 4, 2014 at 06:57:31PM -0400, Tom Lane wrote: > Stephen Frost <sfr...@snowman.net> writes: > > * Tom Lane (t...@sss.pgh.pa.us) wrote: > >> There are at least two places in inv_api.c where we have > >> "Assert(pagelen <= LOBLKSIZE)" that is protecting a subsequent memcpy > >> into a local variable of size LOBLKSIZE, so that the only thing standing > >> between us and a stack-smash security issue that's trivially exploitable > >> in production builds is that on-disk data conforms to our expectation > >> about LOBLKSIZE. I think it's definitely worth promoting these checks > >> to regular runtime-if-test-and-elog. > > > Agreed. Promoting that to a run-time check seems well worth it to me. > > Here's a draft patch for this. Barring objections I'll commit the whole > thing to HEAD, and the inv_api.c changes to the back branches as well.
Uh, I think pg_upgrade needs to check that they match too. -- Bruce Momjian <br...@momjian.us> http://momjian.us EnterpriseDB http://enterprisedb.com + Everyone has their own god. + -- Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers
