a potential size overflow issue

Started by David Zhangalmost 6 years ago2 messageshackers
Beta feature

Hackorum builds and tests every patch posted to the lists, not only commitfest submissions. This is Hackorum's own CI rather than the PostgreSQL project's, and it is still under testing - please report anything that looks wrong.

won't retrysuccessCI history

You can run a PostgreSQL built from this patch straight from Docker, with no checkout and no build:

docker run --rm -p 5432:5432 ghcr.io/hackorum-dev/postgres-patch:t42995
psql -h localhost -U postgres

Built from patchset v1 (message #1), July 27, 2026 at 06:30 PM.

Every patchset is also pushed to a branch of our PostgreSQL fork, so you can check out the same tree CI built. Without a PostgreSQL checkout:

git clone --branch t42995_1 https://github.com/hackorum-dev/postgres.git

In a checkout you already have, add the fork once:

git remote add hackorum https://github.com/hackorum-dev/postgres.git

then, for this patchset and every later one:

git fetch hackorum t42995_1 && git checkout t42995_1

Patchset v1 (message #1) is on t42995_1

Jump to latest
#1David Zhang
david.zhang@highgo.ca

Hi hackers,

"InitBufTable" is the function used to initialize the buffer lookup
table for buffer manager. With the memory size increasing nowadays,
there is a potential overflow issue for the parameter "int size" used by
"InitBufTable". This function is invoked in freelist.c as below:
    InitBufTable(NBuffers + NUM_BUFFER_PARTITIONS);

The number of buffer block “NBuffers” is also defined as "int", and
"NUM_BUFFER_PARTITIONS" has a default value 128. In theory, it may get
the chance to overflow the "size" parameter in "InitBufTable". The
"size" parameter is later used by "ShmemInitHash" as "init_size" and
"max_size", which are all defined as "long".

    SharedBufHash = ShmemInitHash("Shared Buffer Lookup Table",
                                  size, size,
                                  &info,
                                  HASH_ELEM | HASH_BLOBS | HASH_PARTITION);

Therefore, it would be better to change "InitBufTable(int size)" to
"InitBufTable(long size)".

A simple patch is attached and it passed the “make installcheck-world” test.

--

David

Software Engineer
Highgo Software Inc. (Canada)
www.highgo.ca

Attachments:

t42995_1
fix-a-potential-overflow-issue-for-InitBufTable.patchtext/plain; charset=UTF-8; name=fix-a-potential-overflow-issue-for-InitBufTable.patch; x-mac-creator=0; x-mac-type=0Download+2-3
#2Tom Lane
tgl@sss.pgh.pa.us
In reply to: David Zhang (#1)
Re: a potential size overflow issue

David Zhang <david.zhang@highgo.ca> writes:

"InitBufTable" is the function used to initialize the buffer lookup
table for buffer manager. With the memory size increasing nowadays,
there is a potential overflow issue for the parameter "int size" used by
"InitBufTable". This function is invoked in freelist.c as below:
    InitBufTable(NBuffers + NUM_BUFFER_PARTITIONS);

The number of buffer block “NBuffers” is also defined as "int", and
"NUM_BUFFER_PARTITIONS" has a default value 128. In theory, it may get
the chance to overflow the "size" parameter in "InitBufTable".

No, because guc.c limits NBuffers to INT_MAX/2.

Therefore, it would be better to change "InitBufTable(int size)" to
"InitBufTable(long size)".

If I was worried about this, that wouldn't be much of a fix, since
on many platforms "long" is not any wider than "int". (We really
oughta try to move away from relying on "long", because its size
is so poorly standardized.)

regards, tom lane