Fix Windows-only postmaster code to reject a connection request and continue,

rather than elog(FATAL), when there is no more room in ShmemBackendArray.
This is a security issue since too many connection requests arriving close
together could cause the postmaster to shut down, resulting in denial of
service.  Reported by Yoshiyuki Asaba, fixed by Magnus Hagander.

1 files changed, 15 insertions, 2 deletions

diff --git a/src/backend/postmaster/postmaster.c b/src/backend/postmaster/postmaster.c
index b691e0c4eff..518aabd4bf8 100644
--- a/src/backend/postmaster/postmaster.c
+++ b/src/backend/postmaster/postmaster.c
@@ -37,7 +37,7 @@
  *
  *
  * IDENTIFICATION
- *	  $PostgreSQL: pgsql/src/backend/postmaster/postmaster.c,v 1.475.2.1 2005/11/22 18:23:15 momjian Exp $
+ *	  $PostgreSQL: pgsql/src/backend/postmaster/postmaster.c,v 1.475.2.2 2006/01/06 02:58:32 tgl Exp $
  *
  * NOTES
  *
@@ -147,7 +147,11 @@ typedef struct bkend
 static Dllist *BackendList;
 
 #ifdef EXEC_BACKEND
-#define NUM_BACKENDARRAY_ELEMS (2*MaxBackends)
+/* 
+ * Number of entries in the backend table. Twice the number of backends,
+ * plus four other subprocesses (stats, bgwriter, autovac, logger). 
+ */
+#define NUM_BACKENDARRAY_ELEMS (2*MaxBackends + 4)
 static Backend *ShmemBackendArray;
 #endif
 
@@ -3019,6 +3023,15 @@ internal_forkexec(int argc, char *argv[], Port *port)
 	Assert(strncmp(argv[1], "-fork", 5) == 0);
 	Assert(argv[2] == NULL);
 
+	/* Verify that there is room in the child list */
+	if (win32_numChildren >= NUM_BACKENDARRAY_ELEMS)
+	{
+		elog(LOG, "no room for child entry in backend list");
+		/* Report same error as for a fork failure on Unix */
+		errno = EAGAIN;
+		return -1;
+	}
+
 	/* Set up shared memory for parameter passing */
 	ZeroMemory(&sa, sizeof(sa));
 	sa.nLength = sizeof(sa);