mirror of
https://git.postgresql.org/git/postgresql.git
synced 2024-08-31 07:47:22 +02:00
291e517a4d
A couple of code paths use the special area on the page passed by the function caller, expecting to find some data in it. However, feeding an incorrect page can lead to out-of-bound reads when trying to access the page special area (like a heap page that has no special area, leading PageGetSpecialPointer() to grab a pointer outside the allocated page). The functions used for hash and btree indexes have some protection already against that, while some other functions using a relation OID as argument would make sure that the access method involved is correct, but functions taking in input a raw page without knowing the relation the page is attached to would run into problems. This commit improves the set of checks used in the code paths of BRIN, btree (including one check if a leaf page is found with a non-zero level), GIN and GiST to verify that the page given in input has a special area size that fits with each access method, which is done though PageGetSpecialSize(), becore calling PageGetSpecialPointer(). The scope of the checks done is limited to work with pages that one would pass after getting a block with get_raw_page(), as it is possible to craft byteas that could bypass existing code paths. Having too many checks would also impact the usability of pageinspect, as the existing code is very useful to look at the content details in a corrupted page, so the focus is really to avoid out-of-bound reads as this is never a good thing even with functions whose execution is limited to superusers. The safest approach could be to rework the functions so as these fetch a block using a relation OID and a block number, but there are also cases where using a raw page is useful. Tests are added to cover all the code paths that needed such checks, and an error message for hash indexes is reworded to fit better with what this commit adds. Reported-By: Alexander Lakhin Author: Julien Rouhaud, Michael Paquier Discussion: https://postgr.es/m/16527-ef7606186f0610a1@postgresql.org Discussion: https://postgr.es/m/561e187b-3549-c8d5-03f5-525c14e65bd0@postgrespro.ru Backpatch-through: 10
103 lines
3.2 KiB
Plaintext
103 lines
3.2 KiB
Plaintext
CREATE TABLE test1 (a int8, b int4range);
|
|
INSERT INTO test1 VALUES (72057594037927937, '[0,1)');
|
|
CREATE INDEX test1_a_idx ON test1 USING btree (a);
|
|
\x
|
|
SELECT * FROM bt_metap('test1_a_idx');
|
|
-[ RECORD 1 ]-------------+-------
|
|
magic | 340322
|
|
version | 4
|
|
root | 1
|
|
level | 0
|
|
fastroot | 1
|
|
fastlevel | 0
|
|
last_cleanup_num_delpages | 0
|
|
last_cleanup_num_tuples | -1
|
|
allequalimage | t
|
|
|
|
SELECT * FROM bt_page_stats('test1_a_idx', -1);
|
|
ERROR: invalid block number
|
|
SELECT * FROM bt_page_stats('test1_a_idx', 0);
|
|
ERROR: block 0 is a meta page
|
|
SELECT * FROM bt_page_stats('test1_a_idx', 1);
|
|
-[ RECORD 1 ]-+-----
|
|
blkno | 1
|
|
type | l
|
|
live_items | 1
|
|
dead_items | 0
|
|
avg_item_size | 16
|
|
page_size | 8192
|
|
free_size | 8128
|
|
btpo_prev | 0
|
|
btpo_next | 0
|
|
btpo_level | 0
|
|
btpo_flags | 3
|
|
|
|
SELECT * FROM bt_page_stats('test1_a_idx', 2);
|
|
ERROR: block number out of range
|
|
SELECT * FROM bt_page_items('test1_a_idx', -1);
|
|
ERROR: invalid block number
|
|
SELECT * FROM bt_page_items('test1_a_idx', 0);
|
|
ERROR: block 0 is a meta page
|
|
SELECT * FROM bt_page_items('test1_a_idx', 1);
|
|
-[ RECORD 1 ]-----------------------
|
|
itemoffset | 1
|
|
ctid | (0,1)
|
|
itemlen | 16
|
|
nulls | f
|
|
vars | f
|
|
data | 01 00 00 00 00 00 00 01
|
|
dead | f
|
|
htid | (0,1)
|
|
tids |
|
|
|
|
SELECT * FROM bt_page_items('test1_a_idx', 2);
|
|
ERROR: block number out of range
|
|
SELECT * FROM bt_page_items(get_raw_page('test1_a_idx', -1));
|
|
ERROR: invalid block number
|
|
SELECT * FROM bt_page_items(get_raw_page('test1_a_idx', 0));
|
|
ERROR: block is a meta page
|
|
SELECT * FROM bt_page_items(get_raw_page('test1_a_idx', 1));
|
|
-[ RECORD 1 ]-----------------------
|
|
itemoffset | 1
|
|
ctid | (0,1)
|
|
itemlen | 16
|
|
nulls | f
|
|
vars | f
|
|
data | 01 00 00 00 00 00 00 01
|
|
dead | f
|
|
htid | (0,1)
|
|
tids |
|
|
|
|
SELECT * FROM bt_page_items(get_raw_page('test1_a_idx', 2));
|
|
ERROR: block number 2 is out of range for relation "test1_a_idx"
|
|
-- Failure when using a non-btree index.
|
|
CREATE INDEX test1_a_hash ON test1 USING hash(a);
|
|
SELECT bt_metap('test1_a_hash');
|
|
ERROR: "test1_a_hash" is not a btree index
|
|
SELECT bt_page_stats('test1_a_hash', 0);
|
|
ERROR: "test1_a_hash" is not a btree index
|
|
SELECT bt_page_items('test1_a_hash', 0);
|
|
ERROR: "test1_a_hash" is not a btree index
|
|
SELECT bt_page_items(get_raw_page('test1_a_hash', 0));
|
|
ERROR: block is a meta page
|
|
CREATE INDEX test1_b_gist ON test1 USING gist(b);
|
|
-- Special area of GiST is the same as btree, this complains about inconsistent
|
|
-- leaf data on the page.
|
|
SELECT bt_page_items(get_raw_page('test1_b_gist', 0));
|
|
ERROR: block is not a valid btree leaf page
|
|
-- Several failure modes.
|
|
-- Suppress the DETAIL message, to allow the tests to work across various
|
|
-- page sizes and architectures.
|
|
\set VERBOSITY terse
|
|
-- invalid page size
|
|
SELECT bt_page_items('aaa'::bytea);
|
|
ERROR: invalid page size
|
|
-- invalid special area size
|
|
CREATE INDEX test1_a_brin ON test1 USING brin(a);
|
|
SELECT bt_page_items(get_raw_page('test1', 0));
|
|
ERROR: input page is not a valid btree page
|
|
SELECT bt_page_items(get_raw_page('test1_a_brin', 0));
|
|
ERROR: input page is not a valid btree page
|
|
\set VERBOSITY default
|
|
DROP TABLE test1;
|