Make palloc_array() and friends safe against integer overflow.

Sufficiently large "count" arguments could result in undetected
overflow, causing the allocated memory chunk to be much smaller
than what the caller will subsequently write into it.  This is
unlikely to be a hazard with 64-bit size_t but can sometimes
happen on 32-bit builds, primarily where a function allocates
workspace that's significantly larger than its input data.
Rather than trying to patch the at-risk callers piecemeal,
let's just redefine these macros so that they always check.

To do that, move the longstanding add_size() and mul_size() functions
into palloc.h and mcxt.c, and adjust them to not be specific to
shared-memory allocation.  Then invent palloc_mul(), palloc0_mul(),
palloc_mul_extended() to use these functions.  Actually, the latter
use inlined copies to save one function call.  repalloc_array() gets
similar treatment.  I didn't bother trying to inline the calls for
repalloc0_array() though.

In v14 and v15, this also adds repalloc_extended(), which previously
was only available in v16 and up.

We need copies of all this in fe_memutils.[hc] as well, since that
module also provides palloc_array() etc.

Reported-by: Xint Code
Author: Tom Lane <tgl@sss.pgh.pa.us>
Reviewed-by: Masahiko Sawada <sawada.mshk@gmail.com>
Backpatch-through: 14
Security: CVE-2026-6473

diff --git a/src/backend/storage/ipc/shmem.c b/src/backend/storage/ipc/shmem.c
index 6d5f08398641cf0d35256590cb13449c3d1c08dc..5459cf9f9e47217957ce90a11f026eaa8d55cec7 100644 (file)
--- a/src/backend/storage/ipc/shmem.c
+++ b/src/backend/storage/ipc/shmem.c
@@ -486,42 +486,6 @@ ShmemInitStruct(const char *name, Size size, bool *foundPtr)
 }
 
 
-/*
- * Add two Size values, checking for overflow
- */
-Size
-add_size(Size s1, Size s2)
-{
-       Size            result;
-
-       result = s1 + s2;
-       /* We are assuming Size is an unsigned type here... */
-       if (result < s1 || result < s2)
-               ereport(ERROR,
-                               (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
-                                errmsg("requested shared memory size overflows size_t")));
-       return result;
-}
-
-/*
- * Multiply two Size values, checking for overflow
- */
-Size
-mul_size(Size s1, Size s2)
-{
-       Size            result;
-
-       if (s1 == 0 || s2 == 0)
-               return 0;
-       result = s1 * s2;
-       /* We are assuming Size is an unsigned type here... */
-       if (result / s2 != s1)
-               ereport(ERROR,
-                               (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
-                                errmsg("requested shared memory size overflows size_t")));
-       return result;
-}
-
 /* SQL SRF showing allocated shared memory */
 Datum
 pg_get_shmem_allocations(PG_FUNCTION_ARGS)

diff --git a/src/backend/utils/mmgr/mcxt.c b/src/backend/utils/mmgr/mcxt.c
index 4e1fe68d5887e2716fd8a705740106b8acd7b0e4..4542a1b1cd1e49955b5acee341965aef0b088615 100644 (file)
--- a/src/backend/utils/mmgr/mcxt.c
+++ b/src/backend/utils/mmgr/mcxt.c
@@ -21,6 +21,7 @@
 
 #include "postgres.h"
 
+#include "common/int.h"
 #include "mb/pg_wchar.h"
 #include "miscadmin.h"
 #include "utils/memdebug.h"
@@ -169,6 +170,8 @@ static void MemoryContextStatsInternal(MemoryContext context, int level,
 static void MemoryContextStatsPrint(MemoryContext context, void *passthru,
                                                                        const char *stats_string,
                                                                        bool print_to_stderr);
+static pg_noinline void add_size_error(Size s1, Size s2) pg_attribute_noreturn();
+static pg_noinline void mul_size_error(Size s1, Size s2) pg_attribute_noreturn();
 
 /*
  * You should not do memory allocations within a critical section, because
@@ -1651,6 +1654,132 @@ repalloc0(void *pointer, Size oldsize, Size size)
        return ret;
 }
 
+/*
+ * Support for safe calculation of memory request sizes
+ *
+ * These functions perform the requested calculation, but throw error if the
+ * result overflows.
+ *
+ * An important property of these functions is that if an argument was a
+ * negative signed int before promotion (implying overflow in calculating it)
+ * we will detect that as an error.  That happens because we reject results
+ * larger than SIZE_MAX / 2 later on, in the actual allocation step.
+ */
+Size
+add_size(Size s1, Size s2)
+{
+       Size            result;
+
+       if (unlikely(pg_add_size_overflow(s1, s2, &result)))
+               add_size_error(s1, s2);
+       return result;
+}
+
+static pg_noinline void
+add_size_error(Size s1, Size s2)
+{
+       ereport(ERROR,
+                       (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+                        errmsg("invalid memory allocation request size %zu + %zu",
+                                       s1, s2)));
+}
+
+Size
+mul_size(Size s1, Size s2)
+{
+       Size            result;
+
+       if (unlikely(pg_mul_size_overflow(s1, s2, &result)))
+               mul_size_error(s1, s2);
+       return result;
+}
+
+static pg_noinline void
+mul_size_error(Size s1, Size s2)
+{
+       ereport(ERROR,
+                       (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
+                        errmsg("invalid memory allocation request size %zu * %zu",
+                                       s1, s2)));
+}
+
+/*
+ * palloc_mul
+ *             Equivalent to palloc(mul_size(s1, s2)).
+ */
+void *
+palloc_mul(Size s1, Size s2)
+{
+       /* inline mul_size() for efficiency */
+       Size            req;
+
+       if (unlikely(pg_mul_size_overflow(s1, s2, &req)))
+               mul_size_error(s1, s2);
+       return palloc(req);
+}
+
+/*
+ * palloc0_mul
+ *             Equivalent to palloc0(mul_size(s1, s2)).
+ *
+ * This is comparable to standard calloc's behavior.
+ */
+void *
+palloc0_mul(Size s1, Size s2)
+{
+       /* inline mul_size() for efficiency */
+       Size            req;
+
+       if (unlikely(pg_mul_size_overflow(s1, s2, &req)))
+               mul_size_error(s1, s2);
+       return palloc0(req);
+}
+
+/*
+ * palloc_mul_extended
+ *             Equivalent to palloc_extended(mul_size(s1, s2), flags).
+ */
+void *
+palloc_mul_extended(Size s1, Size s2, int flags)
+{
+       /* inline mul_size() for efficiency */
+       Size            req;
+
+       if (unlikely(pg_mul_size_overflow(s1, s2, &req)))
+               mul_size_error(s1, s2);
+       return palloc_extended(req, flags);
+}
+
+/*
+ * repalloc_mul
+ *             Equivalent to repalloc(p, mul_size(s1, s2)).
+ */
+void *
+repalloc_mul(void *p, Size s1, Size s2)
+{
+       /* inline mul_size() for efficiency */
+       Size            req;
+
+       if (unlikely(pg_mul_size_overflow(s1, s2, &req)))
+               mul_size_error(s1, s2);
+       return repalloc(p, req);
+}
+
+/*
+ * repalloc_mul_extended
+ *             Equivalent to repalloc_extended(p, mul_size(s1, s2), flags).
+ */
+void *
+repalloc_mul_extended(void *p, Size s1, Size s2, int flags)
+{
+       /* inline mul_size() for efficiency */
+       Size            req;
+
+       if (unlikely(pg_mul_size_overflow(s1, s2, &req)))
+               mul_size_error(s1, s2);
+       return repalloc_extended(p, req, flags);
+}
+
 /*
  * MemoryContextAllocHuge
  *             Allocate (possibly-expansive) space within the specified context.

diff --git a/src/common/fe_memutils.c b/src/common/fe_memutils.c
index f17a9a5d9f6a3673a4589e9410d44a8ee327e02e..1fd427287e5755b20f4c42ac5e3dc5efcfd42a3b 100644 (file)
--- a/src/common/fe_memutils.c
+++ b/src/common/fe_memutils.c
@@ -19,6 +19,12 @@
 
 #include "postgres_fe.h"
 
+#include "common/int.h"
+
+static pg_noinline void add_size_error(Size s1, Size s2) pg_attribute_noreturn();
+static pg_noinline void mul_size_error(Size s1, Size s2) pg_attribute_noreturn();
+
+
 static inline void *
 pg_malloc_internal(size_t size, int flags)
 {
@@ -173,3 +179,185 @@ repalloc(void *pointer, Size size)
 {
        return pg_realloc(pointer, size);
 }
+
+/*
+ * Support for safe calculation of memory request sizes
+ *
+ * These functions perform the requested calculation, but throw error if the
+ * result overflows.
+ *
+ * An important property of these functions is that if an argument was a
+ * negative signed int before promotion (implying overflow in calculating it)
+ * we will detect that as an error.  That happens because we reject results
+ * larger than SIZE_MAX / 2.  In the backend we rely on later checks to do
+ * that, but in frontend we must do it here.
+ */
+Size
+add_size(Size s1, Size s2)
+{
+       Size            result;
+
+       if (unlikely(pg_add_size_overflow(s1, s2, &result) ||
+                                result > (SIZE_MAX / 2)))
+               add_size_error(s1, s2);
+       return result;
+}
+
+static pg_noinline void
+add_size_error(Size s1, Size s2)
+{
+       fprintf(stderr, _("invalid memory allocation request size %zu + %zu\n"),
+                       s1, s2);
+       exit(EXIT_FAILURE);
+}
+
+Size
+mul_size(Size s1, Size s2)
+{
+       Size            result;
+
+       if (unlikely(pg_mul_size_overflow(s1, s2, &result) ||
+                                result > (SIZE_MAX / 2)))
+               mul_size_error(s1, s2);
+       return result;
+}
+
+static pg_noinline void
+mul_size_error(Size s1, Size s2)
+{
+       fprintf(stderr, _("invalid memory allocation request size %zu * %zu\n"),
+                       s1, s2);
+       exit(EXIT_FAILURE);
+}
+
+/*
+ * pg_malloc_mul
+ *             Equivalent to pg_malloc(mul_size(s1, s2)).
+ */
+void *
+pg_malloc_mul(Size s1, Size s2)
+{
+       /* inline mul_size() for efficiency */
+       Size            req;
+
+       if (unlikely(pg_mul_size_overflow(s1, s2, &req) ||
+                                req > (SIZE_MAX / 2)))
+               mul_size_error(s1, s2);
+       return pg_malloc(req);
+}
+
+/*
+ * pg_malloc0_mul
+ *             Equivalent to pg_malloc0(mul_size(s1, s2)).
+ *
+ * This is comparable to standard calloc's behavior.
+ */
+void *
+pg_malloc0_mul(Size s1, Size s2)
+{
+       /* inline mul_size() for efficiency */
+       Size            req;
+
+       if (unlikely(pg_mul_size_overflow(s1, s2, &req) ||
+                                req > (SIZE_MAX / 2)))
+               mul_size_error(s1, s2);
+       return pg_malloc0(req);
+}
+
+/*
+ * pg_malloc_mul_extended
+ *             Equivalent to pg_malloc_extended(mul_size(s1, s2), flags).
+ */
+void *
+pg_malloc_mul_extended(Size s1, Size s2, int flags)
+{
+       /* inline mul_size() for efficiency */
+       Size            req;
+
+       if (unlikely(pg_mul_size_overflow(s1, s2, &req) ||
+                                req > (SIZE_MAX / 2)))
+               mul_size_error(s1, s2);
+       return pg_malloc_extended(req, flags);
+}
+
+/*
+ * pg_realloc_mul
+ *             Equivalent to pg_realloc(p, mul_size(s1, s2)).
+ */
+void *
+pg_realloc_mul(void *p, Size s1, Size s2)
+{
+       /* inline mul_size() for efficiency */
+       Size            req;
+
+       if (unlikely(pg_mul_size_overflow(s1, s2, &req) ||
+                                req > (SIZE_MAX / 2)))
+               mul_size_error(s1, s2);
+       return pg_realloc(p, req);
+}
+
+/*
+ * palloc_mul
+ *             Equivalent to palloc(mul_size(s1, s2)).
+ */
+void *
+palloc_mul(Size s1, Size s2)
+{
+       /* inline mul_size() for efficiency */
+       Size            req;
+
+       if (unlikely(pg_mul_size_overflow(s1, s2, &req) ||
+                                req > (SIZE_MAX / 2)))
+               mul_size_error(s1, s2);
+       return palloc(req);
+}
+
+/*
+ * palloc0_mul
+ *             Equivalent to palloc0(mul_size(s1, s2)).
+ *
+ * This is comparable to standard calloc's behavior.
+ */
+void *
+palloc0_mul(Size s1, Size s2)
+{
+       /* inline mul_size() for efficiency */
+       Size            req;
+
+       if (unlikely(pg_mul_size_overflow(s1, s2, &req) ||
+                                req > (SIZE_MAX / 2)))
+               mul_size_error(s1, s2);
+       return palloc0(req);
+}
+
+/*
+ * palloc_mul_extended
+ *             Equivalent to palloc_extended(mul_size(s1, s2), flags).
+ */
+void *
+palloc_mul_extended(Size s1, Size s2, int flags)
+{
+       /* inline mul_size() for efficiency */
+       Size            req;
+
+       if (unlikely(pg_mul_size_overflow(s1, s2, &req) ||
+                                req > (SIZE_MAX / 2)))
+               mul_size_error(s1, s2);
+       return palloc_extended(req, flags);
+}
+
+/*
+ * repalloc_mul
+ *             Equivalent to repalloc(p, mul_size(s1, s2)).
+ */
+void *
+repalloc_mul(void *p, Size s1, Size s2)
+{
+       /* inline mul_size() for efficiency */
+       Size            req;
+
+       if (unlikely(pg_mul_size_overflow(s1, s2, &req) ||
+                                req > (SIZE_MAX / 2)))
+               mul_size_error(s1, s2);
+       return repalloc(p, req);
+}

diff --git a/src/include/common/fe_memutils.h b/src/include/common/fe_memutils.h
index 492cc97e8d19accf85a68916f75abe0b2e08f9ae..8c82a86830b5b6338106d6abbeb0deae2f74a6a9 100644 (file)
--- a/src/include/common/fe_memutils.h
+++ b/src/include/common/fe_memutils.h
@@ -29,6 +29,16 @@ extern void *pg_malloc_extended(size_t size, int flags);
 extern void *pg_realloc(void *ptr, size_t size);
 extern void pg_free(void *ptr);
 
+/*
+ * Support for safe calculation of memory request sizes
+ */
+extern Size add_size(Size s1, Size s2);
+extern Size mul_size(Size s1, Size s2);
+extern void *pg_malloc_mul(Size s1, Size s2);
+extern void *pg_malloc0_mul(Size s1, Size s2);
+extern void *pg_malloc_mul_extended(Size s1, Size s2, int flags);
+extern void *pg_realloc_mul(void *p, Size s1, Size s2);
+
 /*
  * Variants with easier notation and more type safety
  */
@@ -42,14 +52,15 @@ extern void pg_free(void *ptr);
 /*
  * Allocate space for "count" objects of type "type"
  */
-#define pg_malloc_array(type, count) ((type *) pg_malloc(sizeof(type) * (count)))
-#define pg_malloc0_array(type, count) ((type *) pg_malloc0(sizeof(type) * (count)))
+#define pg_malloc_array(type, count) ((type *) pg_malloc_mul(sizeof(type), count))
+#define pg_malloc0_array(type, count) ((type *) pg_malloc0_mul(sizeof(type), count))
+#define pg_malloc_array_extended(type, count, flags) ((type *) pg_malloc_mul_extended(sizeof(type), count, flags))
 
 /*
  * Change size of allocation pointed to by "pointer" to have space for "count"
  * objects of type "type"
  */
-#define pg_realloc_array(pointer, type, count) ((type *) pg_realloc(pointer, sizeof(type) * (count)))
+#define pg_realloc_array(pointer, type, count) ((type *) pg_realloc_mul(pointer, sizeof(type), count))
 
 /* Equivalent functions, deliberately named the same as backend functions */
 extern char *pstrdup(const char *in);
@@ -59,12 +70,17 @@ extern void *palloc0(Size size);
 extern void *palloc_extended(Size size, int flags);
 extern void *repalloc(void *pointer, Size size);
 extern void pfree(void *pointer);
+extern void *palloc_mul(Size s1, Size s2);
+extern void *palloc0_mul(Size s1, Size s2);
+extern void *palloc_mul_extended(Size s1, Size s2, int flags);
+extern void *repalloc_mul(void *p, Size s1, Size s2);
 
 #define palloc_object(type) ((type *) palloc(sizeof(type)))
 #define palloc0_object(type) ((type *) palloc0(sizeof(type)))
-#define palloc_array(type, count) ((type *) palloc(sizeof(type) * (count)))
-#define palloc0_array(type, count) ((type *) palloc0(sizeof(type) * (count)))
-#define repalloc_array(pointer, type, count) ((type *) repalloc(pointer, sizeof(type) * (count)))
+#define palloc_array(type, count) ((type *) palloc_mul(sizeof(type), count))
+#define palloc0_array(type, count) ((type *) palloc0_mul(sizeof(type), count))
+#define palloc_array_extended(type, count, flags) ((type *) palloc_mul_extended(sizeof(type), count, flags))
+#define repalloc_array(pointer, type, count) ((type *) repalloc_mul(pointer, sizeof(type), count))
 
 /* sprintf into a palloc'd buffer --- these are in psprintf.c */
 extern char *psprintf(const char *fmt,...) pg_attribute_printf(1, 2);

diff --git a/src/include/storage/shmem.h b/src/include/storage/shmem.h
index 3b0cc9d380033c22b9a79e26e16f3b4735cee7ec..19edde1bee8199d25ae6217ed4b7c3e6def1a8e4 100644 (file)
--- a/src/include/storage/shmem.h
+++ b/src/include/storage/shmem.h
@@ -35,8 +35,6 @@ extern void InitShmemIndex(void);
 extern HTAB *ShmemInitHash(const char *name, long init_size, long max_size,
                                                   HASHCTL *infoP, int hash_flags);
 extern void *ShmemInitStruct(const char *name, Size size, bool *foundPtr);
-extern Size add_size(Size s1, Size s2);
-extern Size mul_size(Size s1, Size s2);
 
 /* ipci.c */
 extern void RequestAddinShmemSpace(Size size);

diff --git a/src/include/utils/memutils.h b/src/include/utils/memutils.h
index cd9596ff21930dce7c4eab7ede5ff77f0f78472e..951f911885369f51a1da227d348390a645682e2a 100644 (file)
--- a/src/include/utils/memutils.h
+++ b/src/include/utils/memutils.h
@@ -41,7 +41,7 @@
 
 #define AllocSizeIsValid(size) ((Size) (size) <= MaxAllocSize)
 
-/* Must be less than SIZE_MAX */
+/* Do not make this any bigger; see add_size() and mul_size() */
 #define MaxAllocHugeSize       (SIZE_MAX / 2)
 
 #define InvalidAllocSize       SIZE_MAX

diff --git a/src/include/utils/palloc.h b/src/include/utils/palloc.h
index 773a5d2c34738560c38dfb05680d2880f137e32b..c49ef6deb671c50ac2c698ad49bdf4da898fe905 100644 (file)
--- a/src/include/utils/palloc.h
+++ b/src/include/utils/palloc.h
@@ -85,6 +85,18 @@ extern pg_nodiscard void *repalloc_extended(void *pointer,
 extern pg_nodiscard void *repalloc0(void *pointer, Size oldsize, Size size);
 extern void pfree(void *pointer);
 
+/*
+ * Support for safe calculation of memory request sizes
+ */
+extern Size add_size(Size s1, Size s2);
+extern Size mul_size(Size s1, Size s2);
+extern void *palloc_mul(Size s1, Size s2);
+extern void *palloc0_mul(Size s1, Size s2);
+extern void *palloc_mul_extended(Size s1, Size s2, int flags);
+pg_nodiscard extern void *repalloc_mul(void *p, Size s1, Size s2);
+pg_nodiscard extern void *repalloc_mul_extended(void *p, Size s1, Size s2,
+                                                                                               int flags);
+
 /*
  * Variants with easier notation and more type safety
  */
@@ -98,15 +110,17 @@ extern void pfree(void *pointer);
 /*
  * Allocate space for "count" objects of type "type"
  */
-#define palloc_array(type, count) ((type *) palloc(sizeof(type) * (count)))
-#define palloc0_array(type, count) ((type *) palloc0(sizeof(type) * (count)))
+#define palloc_array(type, count) ((type *) palloc_mul(sizeof(type), count))
+#define palloc0_array(type, count) ((type *) palloc0_mul(sizeof(type), count))
+#define palloc_array_extended(type, count, flags) ((type *) palloc_mul_extended(sizeof(type), count, flags))
 
 /*
  * Change size of allocation pointed to by "pointer" to have space for "count"
  * objects of type "type"
  */
-#define repalloc_array(pointer, type, count) ((type *) repalloc(pointer, sizeof(type) * (count)))
-#define repalloc0_array(pointer, type, oldcount, count) ((type *) repalloc0(pointer, sizeof(type) * (oldcount), sizeof(type) * (count)))
+#define repalloc_array(pointer, type, count) ((type *) repalloc_mul(pointer, sizeof(type), count))
+#define repalloc0_array(pointer, type, oldcount, count) ((type *) repalloc0(pointer, mul_size(sizeof(type), oldcount), mul_size(sizeof(type), count)))
+#define repalloc_array_extended(pointer, type, count, flags) ((type *) repalloc_mul_extended(pointer, sizeof(type), count, flags))
 
 /* Higher-limit allocators. */
 extern void *MemoryContextAllocHuge(MemoryContext context, Size size);