BUG #18910: DEREF_OF_NULL.RET Pointer, returned from function 'palloc0' at simplehash.h:1080, may be NULL
| От | PG Bug reporting form |
|---|---|
| Тема | BUG #18910: DEREF_OF_NULL.RET Pointer, returned from function 'palloc0' at simplehash.h:1080, may be NULL |
| Дата | |
| Msg-id | 18910-d074a42367253385@postgresql.org обсуждение исходный текст |
| Ответы |
Re: BUG #18910: DEREF_OF_NULL.RET Pointer, returned from function 'palloc0' at simplehash.h:1080, may be NULL
|
| Список | pgsql-bugs |
The following bug has been logged on the website:
Bug reference: 18910
Logged by: Eugeny Goryachev
Email address: gorcom2012@gmail.com
PostgreSQL version: 17.4
Operating system: Ubuntu
Description:
DEREF_OF_NULL.RET - Pointer returned from function 'palloc0' at
simplehash.h:1080 may be NULL and is dereferenced at simplehash.h:1105.
Issue Description:
In the file /src/include/lib/simplehash.h, within the SH_STAT() function,
there is a call to palloc0() that may return NULL:
uint32 *collisions = (uint32 *) palloc0(tb->size * sizeof(uint32));
Subsequently, the pointer is dereferenced:
collisions[optimal]++;
If collisions == NULL, this would cause a segmentation fault.
Server-side: No issue exists since the server version of palloc never
returns NULL (throws an error instead).
Client utilities: simplehash is used in tools like pg_dump,
pg_verifybackup, and pg_rewind, which use the frontend version of palloc
(from libpgcommon). The frontend variant can return NULL on memory
allocation failure.
Solution:
A NULL check should be added when the FRONTEND macro is defined.
diff --git a/src/include/lib/simplehash.h b/src/include/lib/simplehash.h
index 3e1b1f94616..c4a1419a202 100644
--- a/src/include/lib/simplehash.h
+++ b/src/include/lib/simplehash.h
@@ -1078,6 +1078,10 @@ SH_STAT(SH_TYPE * tb)
uint32 i;
uint32 *collisions = (uint32 *) palloc0(tb->size *
sizeof(uint32));
+#ifdef FRONTEND
+ if (unlikely(collisions == NULL))
+ pg_fatal("out of memory");
+#endif
uint32 total_collisions = 0;
uint32 max_collisions = 0;
double avg_collisions;
В списке pgsql-bugs по дате отправления: