Clean up assorted failures under clang's -fsanitize=undefined checks.

Most of these are cases where we could call memcpy() or other libc
functions with a NULL pointer and a zero count, which is forbidden
by POSIX even though every production version of libc allows it.
We've fixed such things before in a piecemeal way, but apparently
never made an effort to try to get them all.  I don't claim that
this patch does so either, but it gets every failure I observe in
check-world, using clang 12.0.1 on current RHEL8.

numeric.c has a different issue that the sanitizer doesn't like:
"ln(-1.0)" will compute log10(0) and then try to assign the
resulting -Inf to an integer variable.  We don't actually use the
result in such a case, so there's no live bug.

Back-patch to all supported branches, with the idea that we might
start running a buildfarm member that tests this case.  This includes
back-patching c1132aae3 (Check the size in COPY_POINTER_FIELD),
which previously silenced some of these issues in copyfuncs.c.

Discussion: https://postgr.es/m/CALNJ-vT9r0DSsAOw9OXVJFxLENoVS_68kJ5x0p44atoYH+H4dg@mail.gmail.com
This commit is contained in:
Tom Lane 2022-03-03 18:13:24 -05:00
parent 72918ea86c
commit f727b6ea8f
10 changed files with 52 additions and 48 deletions

View File

@ -200,7 +200,7 @@ combo_init(PX_Combo *cx, const uint8 *key, unsigned klen,
memset(ivbuf, 0, ivs); memset(ivbuf, 0, ivs);
if (ivlen > ivs) if (ivlen > ivs)
memcpy(ivbuf, iv, ivs); memcpy(ivbuf, iv, ivs);
else else if (ivlen > 0)
memcpy(ivbuf, iv, ivlen); memcpy(ivbuf, iv, ivlen);
} }

View File

@ -309,7 +309,7 @@ initscan(HeapScanDesc scan, ScanKey key, bool keep_startblock)
/* /*
* copy the scan key, if appropriate * copy the scan key, if appropriate
*/ */
if (key != NULL) if (key != NULL && scan->rs_base.rs_nkeys > 0)
memcpy(scan->rs_base.rs_key, key, scan->rs_base.rs_nkeys * sizeof(ScanKeyData)); memcpy(scan->rs_base.rs_key, key, scan->rs_base.rs_nkeys * sizeof(ScanKeyData));
/* /*

View File

@ -1520,8 +1520,8 @@ HeapTupleHeaderIsOnlyLocked(HeapTupleHeader tuple)
static bool static bool
TransactionIdInArray(TransactionId xid, TransactionId *xip, Size num) TransactionIdInArray(TransactionId xid, TransactionId *xip, Size num)
{ {
return bsearch(&xid, xip, num, return num > 0 &&
sizeof(TransactionId), xidComparator) != NULL; bsearch(&xid, xip, num, sizeof(TransactionId), xidComparator) != NULL;
} }
/* /*

View File

@ -296,8 +296,9 @@ TransactionIdSetPageStatus(TransactionId xid, int nsubxids,
if (all_xact_same_page && xid == MyPgXact->xid && if (all_xact_same_page && xid == MyPgXact->xid &&
nsubxids <= THRESHOLD_SUBTRANS_CLOG_OPT && nsubxids <= THRESHOLD_SUBTRANS_CLOG_OPT &&
nsubxids == MyPgXact->nxids && nsubxids == MyPgXact->nxids &&
memcmp(subxids, MyProc->subxids.xids, (nsubxids == 0 ||
nsubxids * sizeof(TransactionId)) == 0) memcmp(subxids, MyProc->subxids.xids,
nsubxids * sizeof(TransactionId)) == 0))
{ {
/* /*
* If we can immediately acquire CLogControlLock, we update the status * If we can immediately acquire CLogControlLock, we update the status

View File

@ -5257,8 +5257,9 @@ SerializeTransactionState(Size maxsize, char *start_address)
{ {
if (FullTransactionIdIsValid(s->fullTransactionId)) if (FullTransactionIdIsValid(s->fullTransactionId))
workspace[i++] = XidFromFullTransactionId(s->fullTransactionId); workspace[i++] = XidFromFullTransactionId(s->fullTransactionId);
memcpy(&workspace[i], s->childXids, if (s->nChildXids > 0)
s->nChildXids * sizeof(TransactionId)); memcpy(&workspace[i], s->childXids,
s->nChildXids * sizeof(TransactionId));
i += s->nChildXids; i += s->nChildXids;
} }
Assert(i == nxids); Assert(i == nxids);

View File

@ -57,8 +57,11 @@
#define COPY_POINTER_FIELD(fldname, sz) \ #define COPY_POINTER_FIELD(fldname, sz) \
do { \ do { \
Size _size = (sz); \ Size _size = (sz); \
newnode->fldname = palloc(_size); \ if (_size > 0) \
memcpy(newnode->fldname, from->fldname, _size); \ { \
newnode->fldname = palloc(_size); \
memcpy(newnode->fldname, from->fldname, _size); \
} \
} while (0) } while (0)
/* Copy a parse location field (for Copy, this is same as scalar case) */ /* Copy a parse location field (for Copy, this is same as scalar case) */
@ -293,12 +296,9 @@ _copyRecursiveUnion(const RecursiveUnion *from)
*/ */
COPY_SCALAR_FIELD(wtParam); COPY_SCALAR_FIELD(wtParam);
COPY_SCALAR_FIELD(numCols); COPY_SCALAR_FIELD(numCols);
if (from->numCols > 0) COPY_POINTER_FIELD(dupColIdx, from->numCols * sizeof(AttrNumber));
{ COPY_POINTER_FIELD(dupOperators, from->numCols * sizeof(Oid));
COPY_POINTER_FIELD(dupColIdx, from->numCols * sizeof(AttrNumber)); COPY_POINTER_FIELD(dupCollations, from->numCols * sizeof(Oid));
COPY_POINTER_FIELD(dupOperators, from->numCols * sizeof(Oid));
COPY_POINTER_FIELD(dupCollations, from->numCols * sizeof(Oid));
}
COPY_SCALAR_FIELD(numGroups); COPY_SCALAR_FIELD(numGroups);
return newnode; return newnode;
@ -872,13 +872,10 @@ _copyMergeJoin(const MergeJoin *from)
COPY_SCALAR_FIELD(skip_mark_restore); COPY_SCALAR_FIELD(skip_mark_restore);
COPY_NODE_FIELD(mergeclauses); COPY_NODE_FIELD(mergeclauses);
numCols = list_length(from->mergeclauses); numCols = list_length(from->mergeclauses);
if (numCols > 0) COPY_POINTER_FIELD(mergeFamilies, numCols * sizeof(Oid));
{ COPY_POINTER_FIELD(mergeCollations, numCols * sizeof(Oid));
COPY_POINTER_FIELD(mergeFamilies, numCols * sizeof(Oid)); COPY_POINTER_FIELD(mergeStrategies, numCols * sizeof(int));
COPY_POINTER_FIELD(mergeCollations, numCols * sizeof(Oid)); COPY_POINTER_FIELD(mergeNullsFirst, numCols * sizeof(bool));
COPY_POINTER_FIELD(mergeStrategies, numCols * sizeof(int));
COPY_POINTER_FIELD(mergeNullsFirst, numCols * sizeof(bool));
}
return newnode; return newnode;
} }
@ -979,12 +976,9 @@ _copyAgg(const Agg *from)
COPY_SCALAR_FIELD(aggstrategy); COPY_SCALAR_FIELD(aggstrategy);
COPY_SCALAR_FIELD(aggsplit); COPY_SCALAR_FIELD(aggsplit);
COPY_SCALAR_FIELD(numCols); COPY_SCALAR_FIELD(numCols);
if (from->numCols > 0) COPY_POINTER_FIELD(grpColIdx, from->numCols * sizeof(AttrNumber));
{ COPY_POINTER_FIELD(grpOperators, from->numCols * sizeof(Oid));
COPY_POINTER_FIELD(grpColIdx, from->numCols * sizeof(AttrNumber)); COPY_POINTER_FIELD(grpCollations, from->numCols * sizeof(Oid));
COPY_POINTER_FIELD(grpOperators, from->numCols * sizeof(Oid));
COPY_POINTER_FIELD(grpCollations, from->numCols * sizeof(Oid));
}
COPY_SCALAR_FIELD(numGroups); COPY_SCALAR_FIELD(numGroups);
COPY_BITMAPSET_FIELD(aggParams); COPY_BITMAPSET_FIELD(aggParams);
COPY_NODE_FIELD(groupingSets); COPY_NODE_FIELD(groupingSets);
@ -1005,19 +999,13 @@ _copyWindowAgg(const WindowAgg *from)
COPY_SCALAR_FIELD(winref); COPY_SCALAR_FIELD(winref);
COPY_SCALAR_FIELD(partNumCols); COPY_SCALAR_FIELD(partNumCols);
if (from->partNumCols > 0) COPY_POINTER_FIELD(partColIdx, from->partNumCols * sizeof(AttrNumber));
{ COPY_POINTER_FIELD(partOperators, from->partNumCols * sizeof(Oid));
COPY_POINTER_FIELD(partColIdx, from->partNumCols * sizeof(AttrNumber)); COPY_POINTER_FIELD(partCollations, from->partNumCols * sizeof(Oid));
COPY_POINTER_FIELD(partOperators, from->partNumCols * sizeof(Oid));
COPY_POINTER_FIELD(partCollations, from->partNumCols * sizeof(Oid));
}
COPY_SCALAR_FIELD(ordNumCols); COPY_SCALAR_FIELD(ordNumCols);
if (from->ordNumCols > 0) COPY_POINTER_FIELD(ordColIdx, from->ordNumCols * sizeof(AttrNumber));
{ COPY_POINTER_FIELD(ordOperators, from->ordNumCols * sizeof(Oid));
COPY_POINTER_FIELD(ordColIdx, from->ordNumCols * sizeof(AttrNumber)); COPY_POINTER_FIELD(ordCollations, from->ordNumCols * sizeof(Oid));
COPY_POINTER_FIELD(ordOperators, from->ordNumCols * sizeof(Oid));
COPY_POINTER_FIELD(ordCollations, from->ordNumCols * sizeof(Oid));
}
COPY_SCALAR_FIELD(frameOptions); COPY_SCALAR_FIELD(frameOptions);
COPY_NODE_FIELD(startOffset); COPY_NODE_FIELD(startOffset);
COPY_NODE_FIELD(endOffset); COPY_NODE_FIELD(endOffset);

View File

@ -748,8 +748,11 @@ shm_mq_receive(shm_mq_handle *mqh, Size *nbytesp, void **datap, bool nowait)
/* Copy as much as we can. */ /* Copy as much as we can. */
Assert(mqh->mqh_partial_bytes + rb <= nbytes); Assert(mqh->mqh_partial_bytes + rb <= nbytes);
memcpy(&mqh->mqh_buffer[mqh->mqh_partial_bytes], rawdata, rb); if (rb > 0)
mqh->mqh_partial_bytes += rb; {
memcpy(&mqh->mqh_buffer[mqh->mqh_partial_bytes], rawdata, rb);
mqh->mqh_partial_bytes += rb;
}
/* /*
* Update count of bytes that can be consumed, accounting for * Update count of bytes that can be consumed, accounting for

View File

@ -8130,12 +8130,20 @@ exp_var(const NumericVar *arg, NumericVar *result, int rscale)
* *
* Essentially, we're approximating log10(abs(ln(var))). This is used to * Essentially, we're approximating log10(abs(ln(var))). This is used to
* determine the appropriate rscale when computing natural logarithms. * determine the appropriate rscale when computing natural logarithms.
*
* Note: many callers call this before range-checking the input. Therefore,
* we must be robust against values that are invalid to apply ln() to.
* We don't wish to throw an error here, so just return zero in such cases.
*/ */
static int static int
estimate_ln_dweight(const NumericVar *var) estimate_ln_dweight(const NumericVar *var)
{ {
int ln_dweight; int ln_dweight;
/* Caller should fail on ln(negative), but for the moment return zero */
if (var->sign != NUMERIC_POS)
return 0;
if (cmp_var(var, &const_zero_point_nine) >= 0 && if (cmp_var(var, &const_zero_point_nine) >= 0 &&
cmp_var(var, &const_one_point_one) <= 0) cmp_var(var, &const_one_point_one) <= 0)
{ {

View File

@ -594,12 +594,14 @@ SetTransactionSnapshot(Snapshot sourcesnap, VirtualTransactionId *sourcevxid,
CurrentSnapshot->xmax = sourcesnap->xmax; CurrentSnapshot->xmax = sourcesnap->xmax;
CurrentSnapshot->xcnt = sourcesnap->xcnt; CurrentSnapshot->xcnt = sourcesnap->xcnt;
Assert(sourcesnap->xcnt <= GetMaxSnapshotXidCount()); Assert(sourcesnap->xcnt <= GetMaxSnapshotXidCount());
memcpy(CurrentSnapshot->xip, sourcesnap->xip, if (sourcesnap->xcnt > 0)
sourcesnap->xcnt * sizeof(TransactionId)); memcpy(CurrentSnapshot->xip, sourcesnap->xip,
sourcesnap->xcnt * sizeof(TransactionId));
CurrentSnapshot->subxcnt = sourcesnap->subxcnt; CurrentSnapshot->subxcnt = sourcesnap->subxcnt;
Assert(sourcesnap->subxcnt <= GetMaxSnapshotSubxidCount()); Assert(sourcesnap->subxcnt <= GetMaxSnapshotSubxidCount());
memcpy(CurrentSnapshot->subxip, sourcesnap->subxip, if (sourcesnap->subxcnt > 0)
sourcesnap->subxcnt * sizeof(TransactionId)); memcpy(CurrentSnapshot->subxip, sourcesnap->subxip,
sourcesnap->subxcnt * sizeof(TransactionId));
CurrentSnapshot->suboverflowed = sourcesnap->suboverflowed; CurrentSnapshot->suboverflowed = sourcesnap->suboverflowed;
CurrentSnapshot->takenDuringRecovery = sourcesnap->takenDuringRecovery; CurrentSnapshot->takenDuringRecovery = sourcesnap->takenDuringRecovery;
/* NB: curcid should NOT be copied, it's a local matter */ /* NB: curcid should NOT be copied, it's a local matter */

View File

@ -913,7 +913,8 @@ print_aligned_text(const printTableContent *cont, FILE *fout, bool is_pager)
more_col_wrapping = col_count; more_col_wrapping = col_count;
curr_nl_line = 0; curr_nl_line = 0;
memset(header_done, false, col_count * sizeof(bool)); if (col_count > 0)
memset(header_done, false, col_count * sizeof(bool));
while (more_col_wrapping) while (more_col_wrapping)
{ {
if (opt_border == 2) if (opt_border == 2)