CID 1428952 (#1 of 1): Out-of-bounds access (OVERRUN) (src/backend/commands/async.c)

Hi Tom,

Can you take a look?

Per Coverity.

There is something wrong with the definition of QUEUE_PAGESIZE on async.c

1. #define QUEUE_PAGESIZE BLCKSZ
2. BLCKSZ is  8192
3..sizeof(AsyncQueueControl) is 8080, according to Coverity (Windows 64 bits)

4. (Line 1508)    qe.length = QUEUE_PAGESIZE - offset;

5. offset is zero

6. qe.length is 8192

/* Now copy qe into the shared buffer page */
memcpy(NotifyCtl->shared->page_buffer[slotno] + offset,
  &qe,
  qe.length);

CID 1428952 (#1 of 1): Out-of-bounds access (OVERRUN)  at line 1515, with memcpy call.

9. overrun-buffer-arg: Overrunning struct type AsyncQueueEntry of 8080 bytes by passing it to a function which accesses it at byte offset 8191 using argument qe.length (which evaluates to 8192).

Question:

1. NotifyCtl->shared->page_buffer[slotno] is really struct type AsyncQueueEntry?

regards,

Ranier Vilela