aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMichael Paquier <michael@paquier.xyz>2023-10-03 15:37:18 +0900
committerMichael Paquier <michael@paquier.xyz>2023-10-03 15:37:18 +0900
commit75f31a3f26744ca71a4214d4ab0c7f6cac4a0421 (patch)
treebcef34f78c8091a1e25ab2bce18345c34befc064
parenta06efbc3ac72a455a63635c9cbc56ad3338988cc (diff)
downloadpostgresql-75f31a3f26744ca71a4214d4ab0c7f6cac4a0421.tar.gz
postgresql-75f31a3f26744ca71a4214d4ab0c7f6cac4a0421.zip
Avoid memory size overflow when allocating backend activity buffer
The code in charge of copying the contents of PgBackendStatus to local memory could fail on memory allocation because of an overflow on the amount of memory to use. The overflow can happen when combining a high value track_activity_query_size (max at 1MB) with a large max_connections, when both multiplied get higher than INT32_MAX as both parameters treated as signed integers. This could for example trigger with the following functions, all calling pgstat_read_current_status(): - pg_stat_get_backend_subxact() - pg_stat_get_backend_idset() - pg_stat_get_progress_info() - pg_stat_get_activity() - pg_stat_get_db_numbackends() The change to use MemoryContextAllocHuge() has been introduced in 8d0ddccec636, so backpatch down to 12. Author: Jakub Wartak Discussion: https://postgr.es/m/CAKZiRmw8QSNVw2qNK-dznsatQqz+9DkCquxP0GHbbv1jMkGHMA@mail.gmail.com Backpatch-through: 12
-rw-r--r--src/backend/utils/activity/backend_status.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/src/backend/utils/activity/backend_status.c b/src/backend/utils/activity/backend_status.c
index 722c5acf38d..6e734c6caff 100644
--- a/src/backend/utils/activity/backend_status.c
+++ b/src/backend/utils/activity/backend_status.c
@@ -765,7 +765,8 @@ pgstat_read_current_status(void)
NAMEDATALEN * NumBackendStatSlots);
localactivity = (char *)
MemoryContextAllocHuge(backendStatusSnapContext,
- pgstat_track_activity_query_size * NumBackendStatSlots);
+ (Size) pgstat_track_activity_query_size *
+ (Size) NumBackendStatSlots);
#ifdef USE_SSL
localsslstatus = (PgBackendSSLStatus *)
MemoryContextAlloc(backendStatusSnapContext,