• Tom Lane's avatar
    Avoid possibly accessing off the end of memory in examine_attribute(). · 780a342c
    Tom Lane authored
    Since the last couple of columns of pg_type are often NULL,
    sizeof(FormData_pg_type) can be an overestimate of the actual size of the
    tuple data part.  Therefore memcpy'ing that much out of the catalog cache,
    as analyze.c was doing, poses a small risk of copying past the end of
    memory and incurring SIGSEGV.  No such crash has been identified in the
    field, but we've certainly seen the equivalent happen in other code paths,
    so patch this one all the way back.
    
    Per valgrind testing by Noah Misch, though this is not his proposed patch.
    I chose to use SearchSysCacheCopy1 rather than inventing special-purpose
    infrastructure for copying only the minimal part of a pg_type tuple.
    780a342c
analyze.c 79.1 KB