rdelaage
/
postgresql
mirror of https://git.postgresql.org/git/postgresql.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Clean up assorted failures under clang's -fsanitize=undefined checks. 

Most of these are cases where we could call memcpy() or other libc
functions with a NULL pointer and a zero count, which is forbidden
by POSIX even though every production version of libc allows it.
We've fixed such things before in a piecemeal way, but apparently
never made an effort to try to get them all.  I don't claim that
this patch does so either, but it gets every failure I observe in
check-world, using clang 12.0.1 on current RHEL8.

numeric.c has a different issue that the sanitizer doesn't like:
"ln(-1.0)" will compute log10(0) and then try to assign the
resulting -Inf to an integer variable.  We don't actually use the
result in such a case, so there's no live bug.

Back-patch to all supported branches, with the idea that we might
start running a buildfarm member that tests this case.  This includes
back-patching c1132aae3 (Check the size in COPY_POINTER_FIELD),
which previously silenced some of these issues in copyfuncs.c.

Discussion: https://postgr.es/m/CALNJ-vT9r0DSsAOw9OXVJFxLENoVS_68kJ5x0p44atoYH+H4dg@mail.gmail.com
This commit is contained in:
Tom Lane 2022-03-03 18:13:24 -05:00
parent 5bb3d91ea9
commit f2087e26eb
10 changed files with 48 additions and 44 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
contrib/pgcrypto/px.c
View File

@ -208,7 +208,7 @@ combo_init(PX_Combo *cx, const uint8 *key, unsigned klen,
memset(ivbuf, 0, ivs);
if (ivlen > ivs)
memcpy(ivbuf, iv, ivs);
else
else if (ivlen > 0)
memcpy(ivbuf, iv, ivlen);
}

2
src/backend/access/heap/heapam.c
View File

@ -311,7 +311,7 @@ initscan(HeapScanDesc scan, ScanKey key, bool keep_startblock)
/*
* copy the scan key, if appropriate
*/
if (key != NULL)
if (key != NULL && scan->rs_nkeys > 0)
memcpy(scan->rs_key, key, scan->rs_nkeys * sizeof(ScanKeyData));
/*

5
src/backend/access/transam/clog.c
View File

@ -296,8 +296,9 @@ TransactionIdSetPageStatus(TransactionId xid, int nsubxids,
if (all_xact_same_page && xid == MyPgXact->xid &&
nsubxids <= THRESHOLD_SUBTRANS_CLOG_OPT &&
nsubxids == MyPgXact->nxids &&
memcmp(subxids, MyProc->subxids.xids,
nsubxids * sizeof(TransactionId)) == 0)
(nsubxids == 0 ||
memcmp(subxids, MyProc->subxids.xids,
nsubxids * sizeof(TransactionId)) == 0))
{
/*
* If we can immediately acquire CLogControlLock, we update the status

5
src/backend/access/transam/xact.c
View File

@ -5093,8 +5093,9 @@ SerializeTransactionState(Size maxsize, char *start_address)
{
if (TransactionIdIsValid(s->transactionId))
workspace[i++] = s->transactionId;
memcpy(&workspace[i], s->childXids,
s->nChildXids * sizeof(TransactionId));
if (s->nChildXids > 0)
memcpy(&workspace[i], s->childXids,
s->nChildXids * sizeof(TransactionId));
i += s->nChildXids;
}
Assert(i == nxids);

46
src/backend/nodes/copyfuncs.c
View File

@ -57,8 +57,11 @@
#define COPY_POINTER_FIELD(fldname, sz) \
do { \
Size _size = (sz); \
newnode->fldname = palloc(_size); \
memcpy(newnode->fldname, from->fldname, _size); \
if (_size > 0) \
{ \
newnode->fldname = palloc(_size); \
memcpy(newnode->fldname, from->fldname, _size); \
} \
} while (0)
/* Copy a parse location field (for Copy, this is same as scalar case) */
@ -295,11 +298,8 @@ _copyRecursiveUnion(const RecursiveUnion *from)
*/
COPY_SCALAR_FIELD(wtParam);
COPY_SCALAR_FIELD(numCols);
if (from->numCols > 0)
{
COPY_POINTER_FIELD(dupColIdx, from->numCols * sizeof(AttrNumber));
COPY_POINTER_FIELD(dupOperators, from->numCols * sizeof(Oid));
}
COPY_POINTER_FIELD(dupColIdx, from->numCols * sizeof(AttrNumber));
COPY_POINTER_FIELD(dupOperators, from->numCols * sizeof(Oid));
COPY_SCALAR_FIELD(numGroups);
return newnode;
@ -873,13 +873,10 @@ _copyMergeJoin(const MergeJoin *from)
COPY_SCALAR_FIELD(skip_mark_restore);
COPY_NODE_FIELD(mergeclauses);
numCols = list_length(from->mergeclauses);
if (numCols > 0)
{
COPY_POINTER_FIELD(mergeFamilies, numCols * sizeof(Oid));
COPY_POINTER_FIELD(mergeCollations, numCols * sizeof(Oid));
COPY_POINTER_FIELD(mergeStrategies, numCols * sizeof(int));
COPY_POINTER_FIELD(mergeNullsFirst, numCols * sizeof(bool));
}
COPY_POINTER_FIELD(mergeFamilies, numCols * sizeof(Oid));
COPY_POINTER_FIELD(mergeCollations, numCols * sizeof(Oid));
COPY_POINTER_FIELD(mergeStrategies, numCols * sizeof(int));
COPY_POINTER_FIELD(mergeNullsFirst, numCols * sizeof(bool));
return newnode;
}
@ -976,11 +973,8 @@ _copyAgg(const Agg *from)
COPY_SCALAR_FIELD(aggstrategy);
COPY_SCALAR_FIELD(aggsplit);
COPY_SCALAR_FIELD(numCols);
if (from->numCols > 0)
{
COPY_POINTER_FIELD(grpColIdx, from->numCols * sizeof(AttrNumber));
COPY_POINTER_FIELD(grpOperators, from->numCols * sizeof(Oid));
}
COPY_POINTER_FIELD(grpColIdx, from->numCols * sizeof(AttrNumber));
COPY_POINTER_FIELD(grpOperators, from->numCols * sizeof(Oid));
COPY_SCALAR_FIELD(numGroups);
COPY_BITMAPSET_FIELD(aggParams);
COPY_NODE_FIELD(groupingSets);
@ -1001,17 +995,11 @@ _copyWindowAgg(const WindowAgg *from)
COPY_SCALAR_FIELD(winref);
COPY_SCALAR_FIELD(partNumCols);
if (from->partNumCols > 0)
{
COPY_POINTER_FIELD(partColIdx, from->partNumCols * sizeof(AttrNumber));
COPY_POINTER_FIELD(partOperators, from->partNumCols * sizeof(Oid));
}
COPY_POINTER_FIELD(partColIdx, from->partNumCols * sizeof(AttrNumber));
COPY_POINTER_FIELD(partOperators, from->partNumCols * sizeof(Oid));
COPY_SCALAR_FIELD(ordNumCols);
if (from->ordNumCols > 0)
{
COPY_POINTER_FIELD(ordColIdx, from->ordNumCols * sizeof(AttrNumber));
COPY_POINTER_FIELD(ordOperators, from->ordNumCols * sizeof(Oid));
}
COPY_POINTER_FIELD(ordColIdx, from->ordNumCols * sizeof(AttrNumber));
COPY_POINTER_FIELD(ordOperators, from->ordNumCols * sizeof(Oid));
COPY_SCALAR_FIELD(frameOptions);
COPY_NODE_FIELD(startOffset);
COPY_NODE_FIELD(endOffset);

7
src/backend/storage/ipc/shm_mq.c
View File

@ -748,8 +748,11 @@ shm_mq_receive(shm_mq_handle *mqh, Size *nbytesp, void **datap, bool nowait)
/* Copy as much as we can. */
Assert(mqh->mqh_partial_bytes + rb <= nbytes);
memcpy(&mqh->mqh_buffer[mqh->mqh_partial_bytes], rawdata, rb);
mqh->mqh_partial_bytes += rb;
if (rb > 0)
{
memcpy(&mqh->mqh_buffer[mqh->mqh_partial_bytes], rawdata, rb);
mqh->mqh_partial_bytes += rb;
}
/*
* Update count of bytes that can be consumed, accounting for

8
src/backend/utils/adt/numeric.c
View File

@ -7956,12 +7956,20 @@ exp_var(const NumericVar *arg, NumericVar *result, int rscale)
*
* Essentially, we're approximating log10(abs(ln(var))). This is used to
* determine the appropriate rscale when computing natural logarithms.
*
* Note: many callers call this before range-checking the input. Therefore,
* we must be robust against values that are invalid to apply ln() to.
* We don't wish to throw an error here, so just return zero in such cases.
*/
static int
estimate_ln_dweight(const NumericVar *var)
{
int ln_dweight;
/* Caller should fail on ln(negative), but for the moment return zero */
if (var->sign != NUMERIC_POS)
return 0;
if (cmp_var(var, &const_zero_point_nine) >= 0 &&
cmp_var(var, &const_one_point_one) <= 0)
{

10
src/backend/utils/time/snapmgr.c
View File

@ -592,12 +592,14 @@ SetTransactionSnapshot(Snapshot sourcesnap, VirtualTransactionId *sourcevxid,
CurrentSnapshot->xmax = sourcesnap->xmax;
CurrentSnapshot->xcnt = sourcesnap->xcnt;
Assert(sourcesnap->xcnt <= GetMaxSnapshotXidCount());
memcpy(CurrentSnapshot->xip, sourcesnap->xip,
sourcesnap->xcnt * sizeof(TransactionId));
if (sourcesnap->xcnt > 0)
memcpy(CurrentSnapshot->xip, sourcesnap->xip,
sourcesnap->xcnt * sizeof(TransactionId));
CurrentSnapshot->subxcnt = sourcesnap->subxcnt;
Assert(sourcesnap->subxcnt <= GetMaxSnapshotSubxidCount());
memcpy(CurrentSnapshot->subxip, sourcesnap->subxip,
sourcesnap->subxcnt * sizeof(TransactionId));
if (sourcesnap->subxcnt > 0)
memcpy(CurrentSnapshot->subxip, sourcesnap->subxip,
sourcesnap->subxcnt * sizeof(TransactionId));
CurrentSnapshot->suboverflowed = sourcesnap->suboverflowed;
CurrentSnapshot->takenDuringRecovery = sourcesnap->takenDuringRecovery;
/* NB: curcid should NOT be copied, it's a local matter */

4
src/backend/utils/time/tqual.c
View File

@ -1641,8 +1641,8 @@ HeapTupleHeaderIsOnlyLocked(HeapTupleHeader tuple)
static bool
TransactionIdInArray(TransactionId xid, TransactionId *xip, Size num)
{
return bsearch(&xid, xip, num,
sizeof(TransactionId), xidComparator) != NULL;
return num > 0 &&
bsearch(&xid, xip, num, sizeof(TransactionId), xidComparator) != NULL;
}
/*

3
src/fe_utils/print.c
View File

@ -913,7 +913,8 @@ print_aligned_text(const printTableContent *cont, FILE *fout, bool is_pager)
more_col_wrapping = col_count;
curr_nl_line = 0;
memset(header_done, false, col_count * sizeof(bool));
if (col_count > 0)
memset(header_done, false, col_count * sizeof(bool));
while (more_col_wrapping)
{
if (opt_border == 2)