提交 e14735ca 编写于 作者: Р Роман Зотов 提交者: Ashwin Agrawal

Fix buffer overflow in writeHashEntry()

MAXALIGN(datum_size) can be greater than BUFFER_INCREMENT_SIZE, hence
when allocating the buffer need to make sure buffer has enough space
for writing the next datum.

(cherry picked from commit bb99c441)
上级 abd170f6
......@@ -1626,11 +1626,13 @@ writeHashEntry(AggState *aggstate, BatchFileInfo *file_info,
if ((aggDataOffset + MAXALIGN(datum_size)) >= aggDataBufferSize)
{
aggDataBufferSize += BUFFER_INCREMENT_SIZE;
aggDataBufferSize += MAXALIGN(datum_size) >= BUFFER_INCREMENT_SIZE ?
MAXALIGN(datum_size) + BUFFER_INCREMENT_SIZE : BUFFER_INCREMENT_SIZE;
MemoryContext oldAggContext = MemoryContextSwitchTo(TopMemoryContext);
aggDataBuffer = repalloc(aggDataBuffer, aggDataBufferSize);
MemoryContextSwitchTo(oldAggContext);
}
Assert((aggDataOffset + MAXALIGN(datum_size)) <= aggDataBufferSize);
memcpy((aggDataBuffer + aggDataOffset), datum_value, datum_size);
aggDataOffset += MAXALIGN(datum_size);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册