8000 Add defenses against running with a wrong selection of LOBLKSIZE. · larkly/postgres-docker@d3c9f9c · GitHub
[go: up one dir, main page]
Skip to content

Commit d3c9f9c

Browse files
tglsfdctglsfdc
committed
Add defenses against running with a wrong selection of LOBLKSIZE.
It's critical that the backend's idea of LOBLKSIZE match the way data has actually been divided up in pg_largeobject. While we don't provide any direct way to adjust that value, doing so is a one-line source code change and various people have expressed interest recently in changing it. So, just as with TOAST_MAX_CHUNK_SIZE, it seems prudent to record the value in pg_control and cross-check that the backend's compiled-in setting matches the on-disk data. Also tweak the code in inv_api.c so that fetches from pg_largeobject explicitly verify that the length of the data field is not more than LOBLKSIZE. Formerly we just had Asserts() for that, which is no protection at all in production builds. In some of the call sites an overlength data value would translate directly to a security-relevant stack clobber, so it seems worth one extra runtime comparison to be sure. In the back branches, we can't change the contents of pg_control; but we can still make the extra checks in inv_api.c, which will offer some amount of protection against running with the wrong value of LOBLKSIZE.
1 parent 6bf6e52 commit d3c9f9c

File tree

1 file changed

+39
-45
lines changed

1 file changed

+39
-45
lines changed

‎src/backend/storage/large_object/inv_api.c

Lines changed: 39 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -175,13 +175,38 @@ myLargeObjectExists(Oid loid, Snapshot snapshot)
175175
}
176176

177177

178-
static int32
179-
getbytealen(bytea *data)
178+
/*
179+
* Extract data field from a pg_largeobject tuple, detoasting if needed
180+
* and verifying that the length is sane. Returns data pointer (a bytea *),
181+
* data length, and an indication of whether to pfree the data pointer.
182+
*/
183+
static void
184+
getdatafield(Form_pg_largeobject tuple,
185+
bytea **pdatafield,
186+
int *plen,
187+
bool *pfreeit)
180188
{
181-
Assert(!VARATT_IS_EXTENDED(data));
182-
if (VARSIZE(data) < VARHDRSZ)
183-
elog(ERROR, "invalid VARSIZE(data)");
184-
return (VARSIZE(data) - VARHDRSZ);
189+
bytea *datafield;
190+
int len;
191+
bool freeit;
192+
193+
datafield = &(tuple->data); /* see note at top of file */
194+
freeit = false;
195+
if (VARATT_IS_EXTENDED(datafield))
196+
{
197+
datafield = (bytea *)
198+
heap_tuple_untoast_attr((struct varlena *) datafield);
199+
freeit = true;
200+
}
201+
len = VARSIZE(datafield) - VARHDRSZ;
202+
if (len < 0 || len > LOBLKSIZE)
203+
ereport(ERROR,
204+
(errcode(ERRCODE_DATA_CORRUPTED),
205+
errmsg("pg_largeobject entry for OID %u, page %d has invalid data field size %d",
206+
tuple->loid, tuple->pageno, len)));
207+
*pdatafield = datafield;
208+
*plen = len;
209+
*pfreeit = freeit;
185210
}
186211

187212

@@ -367,20 +392,14 @@ inv_getsize(LargeObjectDesc *obj_desc)
367392
{
368393
Form_pg_largeobject data;
369394
bytea *datafield;
395+
int len;
370396
bool pfreeit;
371397

372398
if (HeapTupleHasNulls(tuple)) /* paranoia */
373399
elog(ERROR, "null field found in pg_largeobject");
374400
data = (Form_pg_largeobject) GETSTRUCT(tuple);
375-
datafield = &(data->data); /* see note at top of file */
376-
pfreeit = false;
377-
if (VARATT_IS_EXTENDED(datafield))
378-
{
379-
datafield = (bytea *)
380-
heap_tuple_untoast_attr((struct varlena *) datafield);
381-
pfreeit = true;
382-
}
383-
lastbyte = data->pageno * LOBLKSIZE + getbytealen(datafield);
401+
getdatafield(data, &datafield, &len, &pfreeit);
402+
lastbyte = data->pageno * LOBLKSIZE + len;
384403
if (pfreeit)
385404
pfree(datafield);
386405
}
@@ -495,15 +514,7 @@ inv_read(LargeObjectDesc *obj_desc, char *buf, int nbytes)
495514
off = (int) (obj_desc->offset - pageoff);
496515
Assert(off >= 0 && off < LOBLKSIZE);
497516

498-
datafield = &(data->data); /* see note at top of file */
499-
pfreeit = false;
500-
if (VARATT_IS_EXTENDED(datafield))
501-
{
502-
datafield = (bytea *)
503-
heap_tuple_untoast_attr((struct varlena *) datafield);
504-
pfreeit = true;
505-
}
506-
len = getbytealen(datafield);
517+
getdatafield(data, &datafield, &len, &pfreeit);
507518
if (len > off)
508519
{
509520
n = len - off;
@@ -622,16 +633,7 @@ inv_write(LargeObjectDesc *obj_desc, const char *buf, int nbytes)
622633
*
623634
* First, load old data into workbuf
624635
*/
625-
datafield = &(olddata->data); /* see note at top of file */
626-
pfreeit = false;
627-
if (VARATT_IS_EXTENDED(datafield))
628-
{
629-
datafield = (bytea *)
630-
heap_tuple_untoast_attr((struct varlena *) datafield);
631-
pfreeit = true;
632-
}
633-
len = getbytealen(datafield);
634-
Assert(len <= LOBLKSIZE);
636+
getdatafield(olddata, &datafield, &len, &pfreeit);
635637
memcpy(workb, VARDATA(datafield), len);
636638
if (pfreeit)
637639
pfree(datafield);
@@ -807,19 +809,11 @@ inv_truncate(LargeObjectDesc *obj_desc, int len)
807809
if (olddata != NULL && olddata->pageno == pageno)
808810
{
809811
/* First, load old data into workbuf */
810-
bytea *datafield = &(olddata->data); /* see note at top of
811-
* file */
812-
bool pfreeit = false;
812+
bytea *datafield;
813813
int pagelen;
814+
bool pfreeit;
814815

815-
if (VARATT_IS_EXTENDED(datafield))
816-
{
817-
datafield = (bytea *)
818-
heap_tuple_untoast_attr((struct varlena *) datafield);
819-
pfreeit = true;
820-
}
821-
pagelen = getbytealen(datafield);
822-
Assert(pagelen <= LOBLKSIZE);
816+
getdatafield(olddata, &datafield, &pagelen, &pfreeit);
823817
memcpy(workb, VARDATA(datafield), pagelen);
824818
if (pfreeit)
825819
pfree(datafield);

0 commit comments

Comments
 (0)
0