BUG #14931: Unchecked attnum value in ATExecAlterColumnType()

The following bug has been logged on the website:

Bug reference: 14931
Logged by: Pan Bian
Email address: bianpan2016@163.com
PostgreSQL version: 10.1
Operating system: Linux
Description:

File: src/backend/commands/tablecmds.c
Function: ATExecAlterColumnType
Line: 8986

The value of field attTup->attnum may be zero or even negative. However, in
function ATExecAlterColumnType(), its value is incorrectly assumed to be
larger than or equal to 1. In an exceptional case, it may lead to a buffer
overflow bug (see lines 8989 and 8990).

For your convenience, I copy and paste related codes as follows:

8978 /* Look up the target column */
8979 heapTup = SearchSysCacheCopyAttName(RelationGetRelid(rel),
colName);
8980 if (!HeapTupleIsValid(heapTup)) /* shouldn't happen */
8981 ereport(ERROR,
8982 (errcode(ERRCODE_UNDEFINED_COLUMN),
8983 errmsg("column \"%s\" of relation \"%s\" does not
exist",
8984 colName, RelationGetRelationName(rel))));
8985 attTup = (Form_pg_attribute) GETSTRUCT(heapTup);
8986 attnum = attTup->attnum;
8987
8988 /* Check for multiple ALTER TYPE on same column --- can't cope
*/
8989 if (attTup->atttypid != tab->oldDesc->attrs[attnum - 1]->atttypid
||
8990 attTup->atttypmod != tab->oldDesc->attrs[attnum -
1]->atttypmod)
8991 ereport(ERROR,
8992 (errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
8993 errmsg("cannot alter type of column \"%s\" twice",
8994 colName)));

I also collect a function (i.e. ATExecDropNotNull) in the same file as an
example, shown as follows:

5616 tuple = SearchSysCacheCopyAttName(RelationGetRelid(rel),
colName);
5617
5618 if (!HeapTupleIsValid(tuple))
5619 ereport(ERROR,
5620 (errcode(ERRCODE_UNDEFINED_COLUMN),
5621 errmsg("column \"%s\" of relation \"%s\" does not
exist",
5622 colName, RelationGetRelationName(rel))));
5623
5624 attnum = ((Form_pg_attribute) GETSTRUCT(tuple))->attnum;
5625
5626 /* Prevent them from altering a system attribute */
5627 if (attnum <= 0)
5628 ereport(ERROR,
5629 (errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
5630 errmsg("cannot alter system column \"%s\"",
5631 colName)));

Thank you!

Pan Bian