From: Tom Lane <tgl@sss.pgh.pa.us>
Date: Sun, 3 Aug 2025 01:26:21 +0000 (-0400)
Subject: Avoid leakage of zero-length arrays in partition_bounds_copy().
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4fbfdde58e4cd091f88737dffa241b08c23d8829;p=thirdparty%2Fpostgresql.git

Avoid leakage of zero-length arrays in partition_bounds_copy().

If ndatums is zero, the code would allocate zero-length boundKinds
and boundDatums chunks, which would have nothing pointing to them,
leading to Valgrind complaints.  Rearrange the code to avoid the
useless pallocs, and also to not bother computing byval/typlen when
they aren't used.

I'm unsure why I didn't see this in my Valgrind testing back in May.
This code hasn't changed since then, but maybe we added a regression
test that reaches this edge case.  Or possibly I just failed to
notice the reports, which do say "0 bytes lost".

Author: Tom Lane <tgl@sss.pgh.pa.us>
Discussion: https://postgr.es/m/285483.1746756246@sss.pgh.pa.us
---

diff --git a/src/backend/partitioning/partbounds.c b/src/backend/partitioning/partbounds.c
index 4bdc2941efb..822cf4ec451 100644
--- a/src/backend/partitioning/partbounds.c
+++ b/src/backend/partitioning/partbounds.c
@@ -1007,9 +1007,6 @@ partition_bounds_copy(PartitionBoundInfo src,
 	int			ndatums;
 	int			nindexes;
 	int			partnatts;
-	bool		hash_part;
-	int			natts;
-	Datum	   *boundDatums;
 
 	dest = (PartitionBoundInfo) palloc(sizeof(PartitionBoundInfoData));
 
@@ -1023,7 +1020,7 @@ partition_bounds_copy(PartitionBoundInfo src,
 
 	dest->datums = (Datum **) palloc(sizeof(Datum *) * ndatums);
 
-	if (src->kind != NULL)
+	if (src->kind != NULL && ndatums > 0)
 	{
 		PartitionRangeDatumKind *boundKinds;
 
@@ -1058,36 +1055,40 @@ partition_bounds_copy(PartitionBoundInfo src,
 	 * For hash partitioning, datums array will have two elements - modulus
 	 * and remainder.
 	 */
-	hash_part = (key->strategy == PARTITION_STRATEGY_HASH);
-	natts = hash_part ? 2 : partnatts;
-	boundDatums = palloc(ndatums * natts * sizeof(Datum));
-
-	for (i = 0; i < ndatums; i++)
+	if (ndatums > 0)
 	{
-		int			j;
-
-		dest->datums[i] = &boundDatums[i * natts];
+		bool		hash_part = (key->strategy == PARTITION_STRATEGY_HASH);
+		int			natts = hash_part ? 2 : partnatts;
+		Datum	   *boundDatums = palloc(ndatums * natts * sizeof(Datum));
 
-		for (j = 0; j < natts; j++)
+		for (i = 0; i < ndatums; i++)
 		{
-			bool		byval;
-			int			typlen;
+			int			j;
 
-			if (hash_part)
-			{
-				typlen = sizeof(int32); /* Always int4 */
-				byval = true;	/* int4 is pass-by-value */
-			}
-			else
+			dest->datums[i] = &boundDatums[i * natts];
+
+			for (j = 0; j < natts; j++)
 			{
-				byval = key->parttypbyval[j];
-				typlen = key->parttyplen[j];
-			}
+				if (dest->kind == NULL ||
+					dest->kind[i][j] == PARTITION_RANGE_DATUM_VALUE)
+				{
+					bool		byval;
+					int			typlen;
 
-			if (dest->kind == NULL ||
-				dest->kind[i][j] == PARTITION_RANGE_DATUM_VALUE)
-				dest->datums[i][j] = datumCopy(src->datums[i][j],
-											   byval, typlen);
+					if (hash_part)
+					{
+						typlen = sizeof(int32); /* Always int4 */
+						byval = true;	/* int4 is pass-by-value */
+					}
+					else
+					{
+						byval = key->parttypbyval[j];
+						typlen = key->parttyplen[j];
+					}
+					dest->datums[i][j] = datumCopy(src->datums[i][j],
+												   byval, typlen);
+				}
+			}
 		}
 	}