From 8f4a369c28be28351ce64e12ac895db515dd5916 Mon Sep 17 00:00:00 2001 From: Robert Haas Date: Fri, 1 Jul 2016 08:51:58 -0400 Subject: [PATCH] Fix crash bug in RestoreSnapshot. If serialized_snapshot->subxcnt > 0 and serialized_snapshot->xcnt == 0, the old coding would do the wrong thing and crash. This can happen on standby servers. Report by Andreas Seltenreich. Patch by Thomas Munro, reviewed by Amit Kapila and tested by Andreas Seltenreich. --- src/backend/utils/time/snapmgr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/backend/utils/time/snapmgr.c b/src/backend/utils/time/snapmgr.c index 6ef2df8a20..9cbe226b22 100644 --- a/src/backend/utils/time/snapmgr.c +++ b/src/backend/utils/time/snapmgr.c @@ -1573,7 +1573,8 @@ RestoreSnapshot(char *start_address) /* Copy SubXIDs, if present. */ if (serialized_snapshot->subxcnt > 0) { - snapshot->subxip = snapshot->xip + serialized_snapshot->xcnt; + snapshot->subxip = ((TransactionId *) (snapshot + 1)) + + serialized_snapshot->xcnt; memcpy(snapshot->subxip, serialized_xids + serialized_snapshot->xcnt, serialized_snapshot->subxcnt * sizeof(TransactionId)); }