From 245a35f96e3a12b7fe19bad88671d75dcbec133c Mon Sep 17 00:00:00 2001 From: Andrew Gierth Date: Thu, 12 Nov 2020 14:34:37 +0000 Subject: [PATCH] pg_trgm: fix crash in 2-item picksplit Whether from size overflow in gistSplit or from secondary splits, picksplit is (rarely) called with exactly two items to split. Formerly, due to special-case handling of the last item, this would lead to access to an uninitialized cache entry; prior to PG 13 this might have been harmless or at worst led to an incorrect union datum, but in 13 onwards it can cause a backend crash from using an uninitialized pointer. Repair by removing the special case, which was deemed not to have been appropriate anyway. Backpatch all the way, because this bug has existed since pg_trgm was added. Per report on IRC from user "ftzdomino". Analysis and testing by me, patch from Alexander Korotkov. Discussion: https://postgr.es/m/87k0usfdxg.fsf@news-spur.riddles.org.uk --- contrib/pg_trgm/trgm_gist.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/contrib/pg_trgm/trgm_gist.c b/contrib/pg_trgm/trgm_gist.c index f52867df32..7c0a2d4344 100644 --- a/contrib/pg_trgm/trgm_gist.c +++ b/contrib/pg_trgm/trgm_gist.c @@ -774,7 +774,7 @@ Datum gtrgm_picksplit(PG_FUNCTION_ARGS) { GistEntryVector *entryvec = (GistEntryVector *) PG_GETARG_POINTER(0); - OffsetNumber maxoff = entryvec->n - 2; + OffsetNumber maxoff = entryvec->n - 1; GIST_SPLITVEC *v = (GIST_SPLITVEC *) PG_GETARG_POINTER(1); OffsetNumber k, j; @@ -797,7 +797,7 @@ gtrgm_picksplit(PG_FUNCTION_ARGS) SPLITCOST *costvector; /* cache the sign data for each existing item */ - cache = (CACHESIGN *) palloc(sizeof(CACHESIGN) * (maxoff + 2)); + cache = (CACHESIGN *) palloc(sizeof(CACHESIGN) * (maxoff + 1)); for (k = FirstOffsetNumber; k <= maxoff; k = OffsetNumberNext(k)) fillcache(&cache[k], GETENTRY(entryvec, k)); @@ -824,7 +824,7 @@ gtrgm_picksplit(PG_FUNCTION_ARGS) } /* initialize the result vectors */ - nbytes = (maxoff + 2) * sizeof(OffsetNumber); + nbytes = maxoff * sizeof(OffsetNumber); v->spl_left = left = (OffsetNumber *) palloc(nbytes); v->spl_right = right = (OffsetNumber *) palloc(nbytes); v->spl_nleft = 0; @@ -860,8 +860,7 @@ gtrgm_picksplit(PG_FUNCTION_ARGS) union_l = GETSIGN(datum_l); union_r = GETSIGN(datum_r); - maxoff = OffsetNumberNext(maxoff); - fillcache(&cache[maxoff], GETENTRY(entryvec, maxoff)); + /* sort before ... */ costvector = (SPLITCOST *) palloc(sizeof(SPLITCOST) * maxoff); for (j = FirstOffsetNumber; j <= maxoff; j = OffsetNumberNext(j)) @@ -947,7 +946,6 @@ gtrgm_picksplit(PG_FUNCTION_ARGS) } } - *right = *left = FirstOffsetNumber; v->spl_ldatum = PointerGetDatum(datum_l); v->spl_rdatum = PointerGetDatum(datum_r);