Re: CVE-2017-7484-induced bugs, or, btree cmp functions are not leakproof?

Поиск
Список
Период
Сортировка
От Tom Lane
Тема Re: CVE-2017-7484-induced bugs, or, btree cmp functions are not leakproof?
Дата
Msg-id 28143.1574285680@sss.pgh.pa.us
обсуждение исходный текст
Ответ на Re: CVE-2017-7484-induced bugs, or, btree cmp functions are not leakproof?  (Amit Langote <amitlangote09@gmail.com>)
Ответы Re: CVE-2017-7484-induced bugs, or, btree cmp functions are not leakproof?
Список pgsql-hackers
Amit Langote <amitlangote09@gmail.com> writes:
> [ v6-0001-Use-root-parent-s-permissions-when-reading-child-.patch ]

I started to review this, and discovered that the new regression test
passes just fine without applying any of the rest of the patch.
Usually we try to design regression test additions so that they
demonstrate that the new code does something different, so this seems
a bit odd.  Can't we set up the test to fail with unpatched code?
Also, the test case contains no expression index, so I can't see how
it'd provide any code coverage for the code added in examine_variable.

The comment for inh_root_relid seems rather inadequate, since it
fails to mention the special case for UNION ALL subqueries.
But do we even need that special case?  It looks to me like the
walk-up-to-parent code is defending against such cases by checking
relkind, so maybe we don't need to throw away info for UNION ALL.
In general, if we're going to add inh_root_relid, I'd like its
definition to be as simple and consistent as possible, because
I'm sure there will be other uses for it.  If it could be something
like "baserel that this otherrel is a child of", full stop,
I think that'd be good.

I don't especially like the logic in examine_simple_variable,
because it walks back up the AppendRelInfo chain but then proceeds
to use
    rte = planner_rt_fetch(rel->inh_root_relid, root);
without any sort of cross-check that it's stopped at that relation
and not some other one.  It'd be better to keep track of the top
parent_relid while walking up, and use that.  Or else make the
loop stop condition be reaching the matching relid.

            regards, tom lane



В списке pgsql-hackers по дате отправления:

Предыдущее
От: Tomas Vondra
Дата:
Сообщение: Re: why doesn't optimizer can pull up where a > ( ... )
Следующее
От: Peter Geoghegan
Дата:
Сообщение: Why is get_actual_variable_range()'s use of SnapshotNonVacuumablesafe during recovery?