glibc qsort() vulnerability

Поиск
Список
Период
Сортировка
От Mats Kindahl
Тема glibc qsort() vulnerability
Дата
Msg-id CA+14426g2Wa9QuUpmakwPxXFWG_1FaY0AsApkvcTBy-YfS6uaw@mail.gmail.com
обсуждение исходный текст
Ответы Re: glibc qsort() vulnerability  (Tom Lane <tgl@sss.pgh.pa.us>)
Список pgsql-hackers
Hi hackers,

There is a bug in glibc's qsort() algorithm that runs the risk of creating an out-of-bounds error if the comparison function is not transitive, for example, if subtraction is used so that it can create an overflow.


I checked the existing functions in the latest version of Postgres source code and most are safe, but there were a few ones that could lead to overflow. I do not know if these can actually lead to problems, but better safe than sorry, so I created a patch to fix those few cases and add a comment to one case that was not clear that it could not overflow.

Best wishes,
Mats Kindahl, Timescale
Вложения

В списке pgsql-hackers по дате отправления:

Предыдущее
От: "Zhijie Hou (Fujitsu)"
Дата:
Сообщение: RE: Synchronizing slots from primary to standby
Следующее
От: Peter Eisentraut
Дата:
Сообщение: Re: Possibility to disable `ALTER SYSTEM`