Dereferenced pointer in tablesample.c

Started by Michael Paquierover 10 years ago3 messages

michael.paquier@gmail.com

over 10 years ago

1 attachment(s)

Hi all,
(Petr in CC)

Coverity is complaining about the following pointer dereference in
tablesample_init@tablesample.c:
+               ExprState  *argstate = ExecInitExpr(argexpr, (PlanState *)
scanstate);
+
+               if (argstate == NULL)
+               {
+                       fcinfo.argnull[i] = true;
+                       fcinfo.arg[i] = (Datum) 0;;
+               }
+
+               fcinfo.arg[i] = ExecEvalExpr(argstate, econtext,
+
 &fcinfo.argnull[i], NULL);

If the expression argstate is NULL when calling ExecInitExpr(), argstate is
going to be NULL and dereferenced afterwards, see execQual.c for more
details. Hence I think that the patch attached should be applied. Thoughts?

At the same time I noted a double semicolon, fixed as well in the attached.
Regards,
--
Michael

Attachments:

20150630_tablesample_dereference.patchtext/x-patch; charset=US-ASCII; name=20150630_tablesample_dereference.patchDownload

diff --git a/src/backend/access/tablesample/tablesample.c b/src/backend/access/tablesample/tablesample.c
index 44a2434..9d443b1 100644
--- a/src/backend/access/tablesample/tablesample.c
+++ b/src/backend/access/tablesample/tablesample.c
@@ -113,11 +113,13 @@ tablesample_init(SampleScanState *scanstate, TableSampleClause *tablesample)
 		if (argstate == NULL)
 		{
 			fcinfo.argnull[i] = true;
-			fcinfo.arg[i] = (Datum) 0;;
+			fcinfo.arg[i] = (Datum) 0;
+		}
+		else
+		{
+			fcinfo.arg[i] = ExecEvalExpr(argstate, econtext,
+										 &fcinfo.argnull[i], NULL);
 		}
-
-		fcinfo.arg[i] = ExecEvalExpr(argstate, econtext,
-									 &fcinfo.argnull[i], NULL);
 		i++;
 	}
 	Assert(i == fcinfo.nargs);

Petr Jelinek

petr@2ndquadrant.com

over 10 years ago

In reply to: Michael Paquier (#1)

1 attachment(s)

Re: Dereferenced pointer in tablesample.c

On 2015-06-30 09:10, Michael Paquier wrote:

Hi all,
(Petr in CC)
Coverity is complaining about the following pointer dereference in
tablesample_init@tablesample.c:
+               ExprState  *argstate = ExecInitExpr(argexpr, (PlanState
*) scanstate);
+
+               if (argstate == NULL)
+               {
+                       fcinfo.argnull[i] = true;
+                       fcinfo.arg[i] = (Datum) 0;;
+               }
+
+               fcinfo.arg[i] = ExecEvalExpr(argstate, econtext,
+
&fcinfo.argnull[i], NULL);
If the expression argstate is NULL when calling ExecInitExpr(), argstate
is going to be NULL and dereferenced afterwards, see execQual.c for more
details. Hence I think that the patch attached should be applied. Thoughts?

Well, yes the ExecEvalExpr should be in the else block if we'd keep the
NULL logic there.

However after rereading the code, ISTM the ExecInitExpr will only return
NULL if the argexpr is NULL and argexpr is added by ParseTableSample
using the transformExpr on every argument which comes from grammar and
those are a_exprs which AFAIK will never be NULL. So I actually think
that the argstate can never be NULL in practice.

Given the above I would just remove the if statement here - it's not
present in any other code that does ExecInitExpr/ExecEvalExpr either.
It's most likely relic of the code that didn't treat the repeatable
separately and just put it into args List.

Patch attached.

--
Petr Jelinek http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Training & Services

Attachments:

tablesample-remove-useless-null-check.difftext/x-patch; name=tablesample-remove-useless-null-check.diffDownload

diff --git a/src/backend/access/tablesample/tablesample.c b/src/backend/access/tablesample/tablesample.c
index 44a2434..d263fe2 100644
--- a/src/backend/access/tablesample/tablesample.c
+++ b/src/backend/access/tablesample/tablesample.c
@@ -110,12 +110,6 @@ tablesample_init(SampleScanState *scanstate, TableSampleClause *tablesample)
 		Expr	   *argexpr = (Expr *) lfirst(arg);
 		ExprState  *argstate = ExecInitExpr(argexpr, (PlanState *) scanstate);
 
-		if (argstate == NULL)
-		{
-			fcinfo.argnull[i] = true;
-			fcinfo.arg[i] = (Datum) 0;;
-		}
-
 		fcinfo.arg[i] = ExecEvalExpr(argstate, econtext,
 									 &fcinfo.argnull[i], NULL);
 		i++;

Tom Lane

tgl@sss.pgh.pa.us

over 10 years ago

In reply to: Petr Jelinek (#2)

Re: Dereferenced pointer in tablesample.c

Petr Jelinek <petr@2ndquadrant.com> writes:

On 2015-06-30 09:10, Michael Paquier wrote:

If the expression argstate is NULL when calling ExecInitExpr(), argstate
is going to be NULL and dereferenced afterwards, see execQual.c for more
details. Hence I think that the patch attached should be applied. Thoughts?

Well, yes the ExecEvalExpr should be in the else block if we'd keep the
NULL logic there.

However after rereading the code, ISTM the ExecInitExpr will only return
NULL if the argexpr is NULL and argexpr is added by ParseTableSample
using the transformExpr on every argument which comes from grammar and
those are a_exprs which AFAIK will never be NULL. So I actually think
that the argstate can never be NULL in practice.

Indeed. ParseTableSample() is badly in need of a rewrite, but I agree
that it's not going to produce null expression trees.

Patch attached.

Will push this shortly.

regards, tom lane

--
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers