From 435251b859ab2af8d138b4d29b9bb564e862530f Mon Sep 17 00:00:00 2001 From: Tom Lane Date: Tue, 7 Jun 2022 15:34:30 -0400 Subject: [PATCH] Fix off-by-one loop termination condition in pg_stat_get_subscription(). pg_stat_get_subscription scanned one more LogicalRepWorker array entry than is really allocated. In the worst case this could lead to SIGSEGV, if the LogicalRepCtx data structure is near the end of shared memory. That seems quite unlikely though (thanks to the ordering of calls in CreateSharedMemoryAndSemaphores) and we've heard no field reports of it. A more likely misbehavior is one row of garbage data in the function's result, but even that is not real likely because of the check that the pid field matches some live backend. Report and fix by Kuntal Ghosh. This bug is old, so back-patch to all supported branches. Discussion: https://postgr.es/m/CAGz5QCJykEDzW6jQK6Yz7Qh_PMtD=95de_7QoocbVR2Qy8hWZA@mail.gmail.com --- src/backend/replication/logical/launcher.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/backend/replication/logical/launcher.c b/src/backend/replication/logical/launcher.c index 8b11cef1c0..87cbe5a11f 100644 --- a/src/backend/replication/logical/launcher.c +++ b/src/backend/replication/logical/launcher.c @@ -1133,7 +1133,7 @@ pg_stat_get_subscription(PG_FUNCTION_ARGS) /* Make sure we get consistent view of the workers. */ LWLockAcquire(LogicalRepWorkerLock, LW_SHARED); - for (i = 0; i <= max_logical_replication_workers; i++) + for (i = 0; i < max_logical_replication_workers; i++) { /* for each row */ Datum values[PG_STAT_GET_SUBSCRIPTION_COLS];