Re: Unsafe access BufferDescriptors array in BufferGetLSNAtomic()

[Xuneng Zhou]

Hi Tender,

I’ve looked through the patch, and I believe there is a potential issue. The 
default size for BufferDescriptors appears to be 16,384. Passing and casting a 
negative buffer ID to a large unsigned integer in GetBufferDescriptor, and then 
using it as an array subscript, could potentially lead to an overflow.

void
BufferManagerShmemInit(void)
{
        bool            foundBufs,
                                foundDescs,
                                foundIOCV,
                                foundBufCkpt;

        /* Align descriptors to a cacheline boundary. */
        BufferDescriptors = (BufferDescPadded *)
                ShmemInitStruct("Buffer Descriptors",
                                                NBuffers * 
sizeof(BufferDescPadded),
                                                &foundDescs);

int                     NBuffers = 16384;

The changes proposed in the patch seem reasonable to me, but it might be 
helpful to include an explanation of the error case and how it’s handled.

Best regards,
[Xuneng]

The new status of this patch is: Waiting on Author