Re: Protect against possible memory corruption (src/backend/access/nbtree/nbtxlog.c)

On 11/07/2021 22:51, Ranier Vilela wrote:
> Hi,
>
> While analyzing a possible use of an uninitialized variable, I checked that
> *_bt_restore_page* can lead to memory corruption,
> by not checking the maximum limit of array items which is
> MaxIndexTuplesPerPage.

> +     /* Protect against corrupted recovery file */
> +     nitems = (len / sizeof(IndexTupleData));
> +     if (nitems < 0 || nitems > MaxIndexTuplesPerPage)
> +             elog(PANIC, "_bt_restore_page: cannot restore %d items to page", nitems);
> +

That's not right. You don't get the number of items by dividing like
that. 'len' includes the tuple data as well, not just the IndexTupleData
header.