Fix crash bug in RestoreSnapshot.

If serialized_snapshot->subxcnt > 0 and serialized_snapshot->xcnt == 0,
the old coding would do the wrong thing and crash.  This can happen
on standby servers.

Report by Andreas Seltenreich.  Patch by Thomas Munro, reviewed by
Amit Kapila and tested by Andreas Seltenreich.
This commit is contained in:
Robert Haas 2016-07-01 08:51:58 -04:00
parent 10c0558ffe
commit 4f9f495889

View File

@ -2016,7 +2016,8 @@ RestoreSnapshot(char *start_address)
/* Copy SubXIDs, if present. */
if (serialized_snapshot->subxcnt > 0)
{
snapshot->subxip = snapshot->xip + serialized_snapshot->xcnt;
snapshot->subxip = ((TransactionId *) (snapshot + 1)) +
serialized_snapshot->xcnt;
memcpy(snapshot->subxip, serialized_xids + serialized_snapshot->xcnt,
serialized_snapshot->subxcnt * sizeof(TransactionId));
}