Re: [HACKERS] doPickSplit stack buffer overflow in XLogInsert?

2014-06-05 Thread Heikki Linnakangas
On 05/06/2014 07:36 PM, Andres Freund wrote: On 2014-05-06 13:33:01 +0300, Heikki Linnakangas wrote: On 03/31/2014 09:08 PM, Robert Haas wrote: On Wed, Mar 26, 2014 at 9:45 PM, Peter Geoghegan wrote: On Wed, Nov 27, 2013 at 9:10 AM, Noah Misch wrote: The threat is that rounding the read siz

Re: [HACKERS] doPickSplit stack buffer overflow in XLogInsert?

2014-05-06 Thread Andres Freund
On 2014-05-06 13:33:01 +0300, Heikki Linnakangas wrote: > On 03/31/2014 09:08 PM, Robert Haas wrote: > >On Wed, Mar 26, 2014 at 9:45 PM, Peter Geoghegan wrote: > >>On Wed, Nov 27, 2013 at 9:10 AM, Noah Misch wrote: > >>>The threat is that rounding the read size up to the next MAXALIGN would > >>

Re: [HACKERS] doPickSplit stack buffer overflow in XLogInsert?

2014-05-06 Thread Heikki Linnakangas
On 03/31/2014 09:08 PM, Robert Haas wrote: On Wed, Mar 26, 2014 at 9:45 PM, Peter Geoghegan wrote: On Wed, Nov 27, 2013 at 9:10 AM, Noah Misch wrote: The threat is that rounding the read size up to the next MAXALIGN would cross into an unreadable memory page, resulting in a SIGSEGV. Every pa

Re: [HACKERS] doPickSplit stack buffer overflow in XLogInsert?

2014-05-05 Thread Andres Freund
Hi, We really should fix this one of these days. On 2014-03-26 18:45:54 -0700, Peter Geoghegan wrote: > Attached patch silences the "Invalid read of size n" complaints of > Valgrind. I agree with your general thoughts around backpatching. Note > that the patch addresses a distinct complaint from

Re: [HACKERS] doPickSplit stack buffer overflow in XLogInsert?

2014-03-31 Thread Robert Haas
On Wed, Mar 26, 2014 at 9:45 PM, Peter Geoghegan wrote: > On Wed, Nov 27, 2013 at 9:10 AM, Noah Misch wrote: >> The threat is that rounding the read size up to the next MAXALIGN would cross >> into an unreadable memory page, resulting in a SIGSEGV. Every palloc chunk >> has MAXALIGN'd size under

Re: [HACKERS] doPickSplit stack buffer overflow in XLogInsert?

2014-03-26 Thread Peter Geoghegan
On Wed, Nov 27, 2013 at 9:10 AM, Noah Misch wrote: > The threat is that rounding the read size up to the next MAXALIGN would cross > into an unreadable memory page, resulting in a SIGSEGV. Every palloc chunk > has MAXALIGN'd size under the hood, so the excess read of "toDelete" cannot > cause a S

Re: [HACKERS] doPickSplit stack buffer overflow in XLogInsert?

2013-11-27 Thread Peter Eisentraut
On 11/26/13, 5:14 PM, Kevin Grittner wrote: > I happened to build in a shell that was still set up for the clang > address sanitizer, and got the attached report. On a rerun it was > repeatable. XLogInsert() seems to read past the end of a variable > allocated on the stack in doPickSplit(). I hav

Re: [HACKERS] doPickSplit stack buffer overflow in XLogInsert?

2013-11-27 Thread Andres Freund
On 2013-11-27 15:29:24 -0500, Noah Misch wrote: > > If you are confident that neither of these is a real risk, I'll > > relax about this. > > If there is a real risk, I'm not seeing it. Me neither. Greetings, Andres Freund -- Andres Freund http://www.2ndQuadrant.com/ Pos

Re: [HACKERS] doPickSplit stack buffer overflow in XLogInsert?

2013-11-27 Thread Noah Misch
On Wed, Nov 27, 2013 at 11:38:23AM -0800, Kevin Grittner wrote: > Noah Misch wrote: > > The threat is that rounding the read size up to the next MAXALIGN > > would cross into an unreadable memory page, resulting in a > > SIGSEGV.  Every palloc chunk has MAXALIGN'd size under the hood, > > so the e

Re: [HACKERS] doPickSplit stack buffer overflow in XLogInsert?

2013-11-27 Thread Kevin Grittner
Noah Misch wrote: > (Kevin, I saw no attachment.) Apologies.  Trying again. > The threat is that rounding the read size up to the next MAXALIGN > would cross into an unreadable memory page, resulting in a > SIGSEGV.  Every palloc chunk has MAXALIGN'd size under the hood, > so the excess read of

Re: [HACKERS] doPickSplit stack buffer overflow in XLogInsert?

2013-11-27 Thread Noah Misch
On Wed, Nov 27, 2013 at 06:23:38AM -0800, Kevin Grittner wrote: > Andres Freund wrote: > > On 2013-11-26 14:14:38 -0800, Kevin Grittner wrote: > > > >> I happened to build in a shell that was still set up for the clang > >> address sanitizer, and got the attached report.  On a rerun it was (Kevin

Re: [HACKERS] doPickSplit stack buffer overflow in XLogInsert?

2013-11-27 Thread Kevin Grittner
Andres Freund wrote: > On 2013-11-26 14:14:38 -0800, Kevin Grittner wrote: > >> I happened to build in a shell that was still set up for the clang >> address sanitizer, and got the attached report.  On a rerun it was >> repeatable.  XLogInsert() seems to read past the end of a variable >> allocate

Re: [HACKERS] doPickSplit stack buffer overflow in XLogInsert?

2013-11-26 Thread Andres Freund
On 2013-11-26 14:14:38 -0800, Kevin Grittner wrote: > I happened to build in a shell that was still set up for the clang > address sanitizer, and got the attached report.  On a rerun it was > repeatable.  XLogInsert() seems to read past the end of a variable > allocated on the stack in doPickSplit(

[HACKERS] doPickSplit stack buffer overflow in XLogInsert?

2013-11-26 Thread Kevin Grittner
I happened to build in a shell that was still set up for the clang address sanitizer, and got the attached report.  On a rerun it was repeatable.  XLogInsert() seems to read past the end of a variable allocated on the stack in doPickSplit(). I haven't tried to analyze it past that, since this part