Skip to content

Commit

Permalink
Avoid memory size overflow when allocating backend activity buffer
Browse files Browse the repository at this point in the history
The code in charge of copying the contents of PgBackendStatus to local
memory could fail on memory allocation because of an overflow on the
amount of memory to use.  The overflow can happen when combining a high
value track_activity_query_size (max at 1MB) with a large
max_connections, when both multiplied get higher than INT32_MAX as both
parameters treated as signed integers.  This could for example trigger
with the following functions, all calling pgstat_read_current_status():
- pg_stat_get_backend_subxact()
- pg_stat_get_backend_idset()
- pg_stat_get_progress_info()
- pg_stat_get_activity()
- pg_stat_get_db_numbackends()

The change to use MemoryContextAllocHuge() has been introduced in
8d0ddcc, so backpatch down to 12.

Author: Jakub Wartak
Discussion: https://postgr.es/m/CAKZiRmw8QSNVw2qNK-dznsatQqz+9DkCquxP0GHbbv1jMkGHMA@mail.gmail.com
Backpatch-through: 12
  • Loading branch information
michaelpq committed Oct 3, 2023
1 parent 6103d2c commit a0b0136
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion src/backend/postmaster/pgstat.c
Expand Up @@ -3409,7 +3409,8 @@ pgstat_read_current_status(void)
NAMEDATALEN * NumBackendStatSlots);
localactivity = (char *)
MemoryContextAllocHuge(pgStatLocalContext,
pgstat_track_activity_query_size * NumBackendStatSlots);
(Size) pgstat_track_activity_query_size *
(Size) NumBackendStatSlots);
#ifdef USE_SSL
localsslstatus = (PgBackendSSLStatus *)
MemoryContextAlloc(pgStatLocalContext,
Expand Down

0 comments on commit a0b0136

Please sign in to comment.