Clean up assorted failures under clang's -fsanitize=undefined checks.

Most of these are cases where we could call memcpy() or other libc
functions with a NULL pointer and a zero count, which is forbidden
by POSIX even though every production version of libc allows it.
We've fixed such things before in a piecemeal way, but apparently
never made an effort to try to get them all.  I don't claim that
this patch does so either, but it gets every failure I observe in
check-world, using clang 12.0.1 on current RHEL8.

numeric.c has a different issue that the sanitizer doesn't like:
"ln(-1.0)" will compute log10(0) and then try to assign the
resulting -Inf to an integer variable.  We don't actually use the
result in such a case, so there's no live bug.

Back-patch to all supported branches, with the idea that we might
start running a buildfarm member that tests this case.  This includes
back-patching c1132aae3 (Check the size in COPY_POINTER_FIELD),
which previously silenced some of these issues in copyfuncs.c.

Discussion: https://postgr.es/m/CALNJ-vT9r0DSsAOw9OXVJFxLENoVS_68kJ5x0p44atoYH+H4dg@mail.gmail.com

diff --git a/contrib/pgcrypto/px.c b/contrib/pgcrypto/px.c
index f26683aa11b9b63463789d6793e688223da1513c..ca6bbf2ddd4c7914059e0f28f2cbfd1dfe41566c 100644 (file)
--- a/contrib/pgcrypto/px.c
+++ b/contrib/pgcrypto/px.c
@@ -208,7 +208,7 @@ combo_init(PX_Combo *cx, const uint8 *key, unsigned klen,
                memset(ivbuf, 0, ivs);
                if (ivlen > ivs)
                        memcpy(ivbuf, iv, ivs);
-               else
+               else if (ivlen > 0)
                        memcpy(ivbuf, iv, ivlen);
        }
 

diff --git a/src/backend/access/heap/heapam.c b/src/backend/access/heap/heapam.c
index 07353198421fdb8bf7ecf76fb203953b729345e6..37a63094436b36e398487eb8b01e75e574618ba6 100644 (file)
--- a/src/backend/access/heap/heapam.c
+++ b/src/backend/access/heap/heapam.c
@@ -311,7 +311,7 @@ initscan(HeapScanDesc scan, ScanKey key, bool keep_startblock)
        /*
         * copy the scan key, if appropriate
         */
-       if (key != NULL)
+       if (key != NULL && scan->rs_nkeys > 0)
                memcpy(scan->rs_key, key, scan->rs_nkeys * sizeof(ScanKeyData));
 
        /*

diff --git a/src/backend/access/transam/clog.c b/src/backend/access/transam/clog.c
index 4f2baa0d3b9b3203e6c60acfd114cd7b751e6c03..b03a4c29893eb8f265409dd428e24f4cd337aa96 100644 (file)
--- a/src/backend/access/transam/clog.c
+++ b/src/backend/access/transam/clog.c
@@ -296,8 +296,9 @@ TransactionIdSetPageStatus(TransactionId xid, int nsubxids,
        if (all_xact_same_page && xid == MyPgXact->xid &&
                nsubxids <= THRESHOLD_SUBTRANS_CLOG_OPT &&
                nsubxids == MyPgXact->nxids &&
-               memcmp(subxids, MyProc->subxids.xids,
-                          nsubxids * sizeof(TransactionId)) == 0)
+               (nsubxids == 0 ||
+                memcmp(subxids, MyProc->subxids.xids,
+                               nsubxids * sizeof(TransactionId)) == 0))
        {
                /*
                 * If we can immediately acquire CLogControlLock, we update the status

diff --git a/src/backend/access/transam/xact.c b/src/backend/access/transam/xact.c
index 53cd904b9a30d60e1c4a7d4753ed4ae2617aae67..e32b05d17fb7beab845658af9cfea4c19cf8ef61 100644 (file)
--- a/src/backend/access/transam/xact.c
+++ b/src/backend/access/transam/xact.c
@@ -5093,8 +5093,9 @@ SerializeTransactionState(Size maxsize, char *start_address)
        {
                if (TransactionIdIsValid(s->transactionId))
                        workspace[i++] = s->transactionId;
-               memcpy(&workspace[i], s->childXids,
-                          s->nChildXids * sizeof(TransactionId));
+               if (s->nChildXids > 0)
+                       memcpy(&workspace[i], s->childXids,
+                                  s->nChildXids * sizeof(TransactionId));
                i += s->nChildXids;
        }
        Assert(i == nxids);

diff --git a/src/backend/nodes/copyfuncs.c b/src/backend/nodes/copyfuncs.c
index 21c57e42fcc19fe17c78c28d3645ce6495e66ca4..48bf386f190e7814c22c89498cae1478541c6194 100644 (file)
--- a/src/backend/nodes/copyfuncs.c
+++ b/src/backend/nodes/copyfuncs.c
@@ -57,8 +57,11 @@
 #define COPY_POINTER_FIELD(fldname, sz) \
        do { \
                Size    _size = (sz); \
-               newnode->fldname = palloc(_size); \
-               memcpy(newnode->fldname, from->fldname, _size); \
+               if (_size > 0) \
+               { \
+                       newnode->fldname = palloc(_size); \
+                       memcpy(newnode->fldname, from->fldname, _size); \
+               } \
        } while (0)
 
 /* Copy a parse location field (for Copy, this is same as scalar case) */
@@ -295,11 +298,8 @@ _copyRecursiveUnion(const RecursiveUnion *from)
         */
        COPY_SCALAR_FIELD(wtParam);
        COPY_SCALAR_FIELD(numCols);
-       if (from->numCols > 0)
-       {
-               COPY_POINTER_FIELD(dupColIdx, from->numCols * sizeof(AttrNumber));
-               COPY_POINTER_FIELD(dupOperators, from->numCols * sizeof(Oid));
-       }
+       COPY_POINTER_FIELD(dupColIdx, from->numCols * sizeof(AttrNumber));
+       COPY_POINTER_FIELD(dupOperators, from->numCols * sizeof(Oid));
        COPY_SCALAR_FIELD(numGroups);
 
        return newnode;
@@ -873,13 +873,10 @@ _copyMergeJoin(const MergeJoin *from)
        COPY_SCALAR_FIELD(skip_mark_restore);
        COPY_NODE_FIELD(mergeclauses);
        numCols = list_length(from->mergeclauses);
-       if (numCols > 0)
-       {
-               COPY_POINTER_FIELD(mergeFamilies, numCols * sizeof(Oid));
-               COPY_POINTER_FIELD(mergeCollations, numCols * sizeof(Oid));
-               COPY_POINTER_FIELD(mergeStrategies, numCols * sizeof(int));
-               COPY_POINTER_FIELD(mergeNullsFirst, numCols * sizeof(bool));
-       }
+       COPY_POINTER_FIELD(mergeFamilies, numCols * sizeof(Oid));
+       COPY_POINTER_FIELD(mergeCollations, numCols * sizeof(Oid));
+       COPY_POINTER_FIELD(mergeStrategies, numCols * sizeof(int));
+       COPY_POINTER_FIELD(mergeNullsFirst, numCols * sizeof(bool));
 
        return newnode;
 }
@@ -976,11 +973,8 @@ _copyAgg(const Agg *from)
        COPY_SCALAR_FIELD(aggstrategy);
        COPY_SCALAR_FIELD(aggsplit);
        COPY_SCALAR_FIELD(numCols);
-       if (from->numCols > 0)
-       {
-               COPY_POINTER_FIELD(grpColIdx, from->numCols * sizeof(AttrNumber));
-               COPY_POINTER_FIELD(grpOperators, from->numCols * sizeof(Oid));
-       }
+       COPY_POINTER_FIELD(grpColIdx, from->numCols * sizeof(AttrNumber));
+       COPY_POINTER_FIELD(grpOperators, from->numCols * sizeof(Oid));
        COPY_SCALAR_FIELD(numGroups);
        COPY_BITMAPSET_FIELD(aggParams);
        COPY_NODE_FIELD(groupingSets);
@@ -1001,17 +995,11 @@ _copyWindowAgg(const WindowAgg *from)
 
        COPY_SCALAR_FIELD(winref);
        COPY_SCALAR_FIELD(partNumCols);
-       if (from->partNumCols > 0)
-       {
-               COPY_POINTER_FIELD(partColIdx, from->partNumCols * sizeof(AttrNumber));
-               COPY_POINTER_FIELD(partOperators, from->partNumCols * sizeof(Oid));
-       }
+       COPY_POINTER_FIELD(partColIdx, from->partNumCols * sizeof(AttrNumber));
+       COPY_POINTER_FIELD(partOperators, from->partNumCols * sizeof(Oid));
        COPY_SCALAR_FIELD(ordNumCols);
-       if (from->ordNumCols > 0)
-       {
-               COPY_POINTER_FIELD(ordColIdx, from->ordNumCols * sizeof(AttrNumber));
-               COPY_POINTER_FIELD(ordOperators, from->ordNumCols * sizeof(Oid));
-       }
+       COPY_POINTER_FIELD(ordColIdx, from->ordNumCols * sizeof(AttrNumber));
+       COPY_POINTER_FIELD(ordOperators, from->ordNumCols * sizeof(Oid));
        COPY_SCALAR_FIELD(frameOptions);
        COPY_NODE_FIELD(startOffset);
        COPY_NODE_FIELD(endOffset);

diff --git a/src/backend/storage/ipc/shm_mq.c b/src/backend/storage/ipc/shm_mq.c
index 3067a30986e545a50b8648aa35deeba6fb99b6c8..67b0399befd8a47394ddaa4cd5ea403c0bef53f0 100644 (file)
--- a/src/backend/storage/ipc/shm_mq.c
+++ b/src/backend/storage/ipc/shm_mq.c
@@ -748,8 +748,11 @@ shm_mq_receive(shm_mq_handle *mqh, Size *nbytesp, void **datap, bool nowait)
 
                /* Copy as much as we can. */
                Assert(mqh->mqh_partial_bytes + rb <= nbytes);
-               memcpy(&mqh->mqh_buffer[mqh->mqh_partial_bytes], rawdata, rb);
-               mqh->mqh_partial_bytes += rb;
+               if (rb > 0)
+               {
+                       memcpy(&mqh->mqh_buffer[mqh->mqh_partial_bytes], rawdata, rb);
+                       mqh->mqh_partial_bytes += rb;
+               }
 
                /*
                 * Update count of bytes that can be consumed, accounting for

diff --git a/src/backend/utils/adt/numeric.c b/src/backend/utils/adt/numeric.c
index 2ef0be6df1c08498ed83e73c8bdf4f6729607e03..c7239af03d5c97dc0fafd26c7fb7711c9abb5040 100644 (file)
--- a/src/backend/utils/adt/numeric.c
+++ b/src/backend/utils/adt/numeric.c
@@ -7956,12 +7956,20 @@ exp_var(const NumericVar *arg, NumericVar *result, int rscale)
  *
  * Essentially, we're approximating log10(abs(ln(var))).  This is used to
  * determine the appropriate rscale when computing natural logarithms.
+ *
+ * Note: many callers call this before range-checking the input.  Therefore,
+ * we must be robust against values that are invalid to apply ln() to.
+ * We don't wish to throw an error here, so just return zero in such cases.
  */
 static int
 estimate_ln_dweight(const NumericVar *var)
 {
        int                     ln_dweight;
 
+       /* Caller should fail on ln(negative), but for the moment return zero */
+       if (var->sign != NUMERIC_POS)
+               return 0;
+
        if (cmp_var(var, &const_zero_point_nine) >= 0 &&
                cmp_var(var, &const_one_point_one) <= 0)
        {

diff --git a/src/backend/utils/time/snapmgr.c b/src/backend/utils/time/snapmgr.c
index f4401060643bb91b879f845493679d01cdf4f299..8fadec32c5fe40ae3bfb44d8312d1f40e89e669a 100644 (file)
--- a/src/backend/utils/time/snapmgr.c
+++ b/src/backend/utils/time/snapmgr.c
@@ -592,12 +592,14 @@ SetTransactionSnapshot(Snapshot sourcesnap, VirtualTransactionId *sourcevxid,
        CurrentSnapshot->xmax = sourcesnap->xmax;
        CurrentSnapshot->xcnt = sourcesnap->xcnt;
        Assert(sourcesnap->xcnt <= GetMaxSnapshotXidCount());
-       memcpy(CurrentSnapshot->xip, sourcesnap->xip,
-                  sourcesnap->xcnt * sizeof(TransactionId));
+       if (sourcesnap->xcnt > 0)
+               memcpy(CurrentSnapshot->xip, sourcesnap->xip,
+                          sourcesnap->xcnt * sizeof(TransactionId));
        CurrentSnapshot->subxcnt = sourcesnap->subxcnt;
        Assert(sourcesnap->subxcnt <= GetMaxSnapshotSubxidCount());
-       memcpy(CurrentSnapshot->subxip, sourcesnap->subxip,
-                  sourcesnap->subxcnt * sizeof(TransactionId));
+       if (sourcesnap->subxcnt > 0)
+               memcpy(CurrentSnapshot->subxip, sourcesnap->subxip,
+                          sourcesnap->subxcnt * sizeof(TransactionId));
        CurrentSnapshot->suboverflowed = sourcesnap->suboverflowed;
        CurrentSnapshot->takenDuringRecovery = sourcesnap->takenDuringRecovery;
        /* NB: curcid should NOT be copied, it's a local matter */

diff --git a/src/backend/utils/time/tqual.c b/src/backend/utils/time/tqual.c
index f7c4c9188ce2dd66a67d62cc91c1c18e4fd7518e..8315cd9cd6da357c62dbd922c3e0876e91dee1d7 100644 (file)
--- a/src/backend/utils/time/tqual.c
+++ b/src/backend/utils/time/tqual.c
@@ -1641,8 +1641,8 @@ HeapTupleHeaderIsOnlyLocked(HeapTupleHeader tuple)
 static bool
 TransactionIdInArray(TransactionId xid, TransactionId *xip, Size num)
 {
-       return bsearch(&xid, xip, num,
-                                  sizeof(TransactionId), xidComparator) != NULL;
+       return num > 0 &&
+               bsearch(&xid, xip, num, sizeof(TransactionId), xidComparator) != NULL;
 }
 
 /*

diff --git a/src/fe_utils/print.c b/src/fe_utils/print.c
index dba19c28f59171a050a88649e55e2d1707d04a20..b1c4b9542747cde03e6e5a74ccc0cd8bf71f66ec 100644 (file)
--- a/src/fe_utils/print.c
+++ b/src/fe_utils/print.c
@@ -913,7 +913,8 @@ print_aligned_text(const printTableContent *cont, FILE *fout, bool is_pager)
 
                        more_col_wrapping = col_count;
                        curr_nl_line = 0;
-                       memset(header_done, false, col_count * sizeof(bool));
+                       if (col_count > 0)
+                               memset(header_done, false, col_count * sizeof(bool));
                        while (more_col_wrapping)
                        {
                                if (opt_border == 2)