[NBTREE] Possible NULL pointer dereference (backend/access/nbtree/nbutils.c)

[Ranier Vilela]

Hi,

Is possible that BTreeTupleSetNAtts, leave everything tidy, so that
BTreeTupleGetHeapTID doesn't fail.
BTreeTupleGetHeapTID can return NULL.

But, as we can see:
1. Line 2085 (nbtutils.c):
    if (BTreeTupleGetHeapTID(itup) != NULL && tupnatts != nkeyatts)
2. Line 803 (nbtsearch.c):
    if (heapTid == NULL)

Maybe, better make sure, because:
3. Line 2285 (nbtutils.c):
    ItemPointerCopy(BTreeTupleGetMaxHeapTID(lastleft), pivotheaptid);
4. Line 2316 (nbtutils.c) :
    ItemPointerCopy(BTreeTupleGetHeapTID(firstright), pivotheaptid);

Can dereference NULL pointer (pivotheaptid) at runtime (release version).

itemptr.h:
#define ItemPointerCopy(fromPointer, toPointer) \
( \
AssertMacro(PointerIsValid(toPointer)), \
AssertMacro(PointerIsValid(fromPointer)), \
*(toPointer) = *(fromPointer) \
)

regards,
Ranier Vilela