Use ereport(ERROR), not Assert(), for publisher tuples missing columns.

Three locations use Assert() to guard against a mismatch between the
number of columns advertised in the RELATION message and the number
actually received in the subsequent INSERT/UPDATE tuple message. Since
these values originate from the publisher, the check must survive into
production builds.

A malicious or buggy publisher can send a RELATION claiming N columns
and an INSERT claiming M < N columns. The subscriber's apply worker
indexes into colvalues[]/colstatus[] using column indices from the
RELATION message's attribute map, causing a heap out-of-bounds read when
the tuple's column array is smaller than expected. We've looked, without
success, for a scenario in which the publisher holds sufficient control
over these out-of-bounds bytes to exploit this or even to reach a
SIGSEGV. Despite not finding one, the code has been fragile. Back-patch
to v14 (all supported versions).

Reported-by: Varik Matevosyan <varikmatevosyan@gmail.com>
Author: Varik Matevosyan <varikmatevosyan@gmail.com>
Discussion: https://postgr.es/m/CA+bBoog3cCogktzfLb9bppUByu-10B3CFp8u=iKXG_OvtAguCw@mail.gmail.com
Backpatch-through: 14

diff --git a/src/backend/replication/logical/worker.c b/src/backend/replication/logical/worker.c
index dd6fc38a41ea083c58514650e391396da7e6ebdd..a3f2406ed83fd583f8081cc2c83af3bd6289ef9f 100644 (file)
--- a/src/backend/replication/logical/worker.c
+++ b/src/backend/replication/logical/worker.c
@@ -1038,9 +1038,15 @@ slot_store_data(TupleTableSlot *slot, LogicalRepRelMapEntry *rel,
 
                if (!att->attisdropped && remoteattnum >= 0)
                {
-                       StringInfo      colvalue = &tupleData->colvalues[remoteattnum];
+                       StringInfo      colvalue;
+
+                       if (remoteattnum >= tupleData->ncols)
+                               ereport(ERROR,
+                                               (errcode(ERRCODE_PROTOCOL_VIOLATION),
+                                                errmsg("logical replication column %d not found in tuple: only %d column(s) received",
+                                                               remoteattnum + 1, tupleData->ncols)));
 
-                       Assert(remoteattnum < tupleData->ncols);
+                       colvalue = &tupleData->colvalues[remoteattnum];
 
                        /* Set attnum for error callback */
                        apply_error_callback_arg.remote_attnum = remoteattnum;
@@ -1151,7 +1157,11 @@ slot_modify_data(TupleTableSlot *slot, TupleTableSlot *srcslot,
                if (remoteattnum < 0)
                        continue;
 
-               Assert(remoteattnum < tupleData->ncols);
+               if (remoteattnum >= tupleData->ncols)
+                       ereport(ERROR,
+                                       (errcode(ERRCODE_PROTOCOL_VIOLATION),
+                                        errmsg("logical replication column %d not found in tuple: only %d column(s) received",
+                                                       remoteattnum + 1, tupleData->ncols)));
 
                if (tupleData->colstatus[remoteattnum] != LOGICALREP_COLUMN_UNCHANGED)
                {
@@ -2870,7 +2880,12 @@ apply_handle_update(StringInfo s)
 
                if (!att->attisdropped && remoteattnum >= 0)
                {
-                       Assert(remoteattnum < newtup.ncols);
+                       if (remoteattnum >= newtup.ncols)
+                               ereport(ERROR,
+                                               (errcode(ERRCODE_PROTOCOL_VIOLATION),
+                                                errmsg("logical replication column %d not found in tuple: only %d column(s) received",
+                                                               remoteattnum + 1, newtup.ncols)));
+
                        if (newtup.colstatus[remoteattnum] != LOGICALREP_COLUMN_UNCHANGED)
                                target_perminfo->updatedCols =
                                        bms_add_member(target_perminfo->updatedCols,