Re: [HACKERS] doPickSplit stack buffer overflow in XLogInsert?

2014-06-05 Thread Heikki Linnakangas
On 05/06/2014 07:36 PM, Andres Freund wrote: On 2014-05-06 13:33:01 +0300, Heikki Linnakangas wrote: On 03/31/2014 09:08 PM, Robert Haas wrote: On Wed, Mar 26, 2014 at 9:45 PM, Peter Geoghegan p...@heroku.com wrote: On Wed, Nov 27, 2013 at 9:10 AM, Noah Misch n...@leadboat.com wrote: The

Re: [HACKERS] doPickSplit stack buffer overflow in XLogInsert?

2014-05-06 Thread Heikki Linnakangas
On 03/31/2014 09:08 PM, Robert Haas wrote: On Wed, Mar 26, 2014 at 9:45 PM, Peter Geoghegan p...@heroku.com wrote: On Wed, Nov 27, 2013 at 9:10 AM, Noah Misch n...@leadboat.com wrote: The threat is that rounding the read size up to the next MAXALIGN would cross into an unreadable memory page,

Re: [HACKERS] doPickSplit stack buffer overflow in XLogInsert?

2014-05-06 Thread Andres Freund
On 2014-05-06 13:33:01 +0300, Heikki Linnakangas wrote: On 03/31/2014 09:08 PM, Robert Haas wrote: On Wed, Mar 26, 2014 at 9:45 PM, Peter Geoghegan p...@heroku.com wrote: On Wed, Nov 27, 2013 at 9:10 AM, Noah Misch n...@leadboat.com wrote: The threat is that rounding the read size up to the

Re: [HACKERS] doPickSplit stack buffer overflow in XLogInsert?

2014-05-05 Thread Andres Freund
Hi, We really should fix this one of these days. On 2014-03-26 18:45:54 -0700, Peter Geoghegan wrote: Attached patch silences the Invalid read of size n complaints of Valgrind. I agree with your general thoughts around backpatching. Note that the patch addresses a distinct complaint from

Re: [HACKERS] doPickSplit stack buffer overflow in XLogInsert?

2014-03-31 Thread Robert Haas
On Wed, Mar 26, 2014 at 9:45 PM, Peter Geoghegan p...@heroku.com wrote: On Wed, Nov 27, 2013 at 9:10 AM, Noah Misch n...@leadboat.com wrote: The threat is that rounding the read size up to the next MAXALIGN would cross into an unreadable memory page, resulting in a SIGSEGV. Every palloc chunk

Re: [HACKERS] doPickSplit stack buffer overflow in XLogInsert?

2014-03-26 Thread Peter Geoghegan
On Wed, Nov 27, 2013 at 9:10 AM, Noah Misch n...@leadboat.com wrote: The threat is that rounding the read size up to the next MAXALIGN would cross into an unreadable memory page, resulting in a SIGSEGV. Every palloc chunk has MAXALIGN'd size under the hood, so the excess read of toDelete

Re: [HACKERS] doPickSplit stack buffer overflow in XLogInsert?

2013-11-27 Thread Kevin Grittner
Andres Freund and...@2ndquadrant.com wrote: On 2013-11-26 14:14:38 -0800, Kevin Grittner wrote: I happened to build in a shell that was still set up for the clang address sanitizer, and got the attached report.  On a rerun it was repeatable.  XLogInsert() seems to read past the end of a

Re: [HACKERS] doPickSplit stack buffer overflow in XLogInsert?

2013-11-27 Thread Noah Misch
On Wed, Nov 27, 2013 at 06:23:38AM -0800, Kevin Grittner wrote: Andres Freund and...@2ndquadrant.com wrote: On 2013-11-26 14:14:38 -0800, Kevin Grittner wrote: I happened to build in a shell that was still set up for the clang address sanitizer, and got the attached report.  On a rerun it

Re: [HACKERS] doPickSplit stack buffer overflow in XLogInsert?

2013-11-27 Thread Kevin Grittner
Noah Misch n...@leadboat.com wrote: (Kevin, I saw no attachment.) Apologies.  Trying again. The threat is that rounding the read size up to the next MAXALIGN would cross into an unreadable memory page, resulting in a SIGSEGV.  Every palloc chunk has MAXALIGN'd size under the hood, so the

Re: [HACKERS] doPickSplit stack buffer overflow in XLogInsert?

2013-11-27 Thread Noah Misch
On Wed, Nov 27, 2013 at 11:38:23AM -0800, Kevin Grittner wrote: Noah Misch n...@leadboat.com wrote: The threat is that rounding the read size up to the next MAXALIGN would cross into an unreadable memory page, resulting in a SIGSEGV.  Every palloc chunk has MAXALIGN'd size under the hood,

Re: [HACKERS] doPickSplit stack buffer overflow in XLogInsert?

2013-11-27 Thread Andres Freund
On 2013-11-27 15:29:24 -0500, Noah Misch wrote: If you are confident that neither of these is a real risk, I'll relax about this. If there is a real risk, I'm not seeing it. Me neither. Greetings, Andres Freund -- Andres Freund http://www.2ndQuadrant.com/

Re: [HACKERS] doPickSplit stack buffer overflow in XLogInsert?

2013-11-27 Thread Peter Eisentraut
On 11/26/13, 5:14 PM, Kevin Grittner wrote: I happened to build in a shell that was still set up for the clang address sanitizer, and got the attached report. On a rerun it was repeatable. XLogInsert() seems to read past the end of a variable allocated on the stack in doPickSplit(). I

[HACKERS] doPickSplit stack buffer overflow in XLogInsert?

2013-11-26 Thread Kevin Grittner
I happened to build in a shell that was still set up for the clang address sanitizer, and got the attached report.  On a rerun it was repeatable.  XLogInsert() seems to read past the end of a variable allocated on the stack in doPickSplit(). I haven't tried to analyze it past that, since this part

Re: [HACKERS] doPickSplit stack buffer overflow in XLogInsert?

2013-11-26 Thread Andres Freund
On 2013-11-26 14:14:38 -0800, Kevin Grittner wrote: I happened to build in a shell that was still set up for the clang address sanitizer, and got the attached report.  On a rerun it was repeatable.  XLogInsert() seems to read past the end of a variable allocated on the stack in doPickSplit().