Skip to content
  • Tom Lane's avatar
    a3c4a91f
    Avoid crash in estimate_array_length with null root pointer. · a3c4a91f
    Tom Lane authored
    Commit 9391f715 added a "PlannerInfo *root" parameter to
    estimate_array_length, but failed to consider the possibility that
    NULL would be passed for that, leading to a null pointer dereference.
    
    We could rectify the particular case shown in the bug report by fixing
    simplify_function/inline_function to pass through the root pointer.
    However, as long as eval_const_expressions is documented to accept
    NULL for root, similar hazards would remain.  For now, let's just do
    the narrow fix of hardening estimate_array_length to not crash.
    Its behavior with NULL root will be the same as it was before
    9391f715, so this is not too awful.
    
    Per report from Fredrik Widlert (via Paul Ramsey).  Back-patch to v17
    where 9391f715 came in.
    
    Discussion: https://postgr.es/m/518339E7-173E-45EC-A0FF-9A4A62AA4F40@cleverelephant.ca
    a3c4a91f
    Avoid crash in estimate_array_length with null root pointer.
    Tom Lane authored
    Commit 9391f715 added a "PlannerInfo *root" parameter to
    estimate_array_length, but failed to consider the possibility that
    NULL would be passed for that, leading to a null pointer dereference.
    
    We could rectify the particular case shown in the bug report by fixing
    simplify_function/inline_function to pass through the root pointer.
    However, as long as eval_const_expressions is documented to accept
    NULL for root, similar hazards would remain.  For now, let's just do
    the narrow fix of hardening estimate_array_length to not crash.
    Its behavior with NULL root will be the same as it was before
    9391f715, so this is not too awful.
    
    Per report from Fredrik Widlert (via Paul Ramsey).  Back-patch to v17
    where 9391f715 came in.
    
    Discussion: https://postgr.es/m/518339E7-173E-45EC-A0FF-9A4A62AA4F40@cleverelephant.ca
Loading