diff options
| author | Robert Haas <rhaas@postgresql.org> | 2014-07-24 09:19:50 -0400 |
|---|---|---|
| committer | Robert Haas <rhaas@postgresql.org> | 2014-07-24 09:19:50 -0400 |
| commit | df58a17df29f7ec0ffc8389deee46e81a2a58a60 (patch) | |
| tree | c0ad765034840147d8829567926a5eba4199c7b5 | |
| parent | 3372f1adad12bc70321fdf22f3c11ac67e429f63 (diff) | |
Prevent shm_mq_send from reading uninitialized memory.
shm_mq_send_bytes didn't invariably initialize *bytes_written before
returning, which would cause shm_mq_send to read from uninitialized
memory and add the value it found there to mqh->mqh_partial_bytes.
This could cause the next attempt to send a message via the queue to
fail an assertion (if the queue was detached) or copy data from a
garbage pointer value into the queue (if non-blocking mode was in use).
| -rw-r--r-- | src/backend/storage/ipc/shm_mq.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/src/backend/storage/ipc/shm_mq.c b/src/backend/storage/ipc/shm_mq.c index 6f9c3a3b6c2..d96627a774e 100644 --- a/src/backend/storage/ipc/shm_mq.c +++ b/src/backend/storage/ipc/shm_mq.c @@ -676,7 +676,10 @@ shm_mq_send_bytes(shm_mq_handle *mqh, Size nbytes, void *data, bool nowait, /* Bail out if the queue has been detached. */ if (detached) + { + *bytes_written = sent; return SHM_MQ_DETACHED; + } if (available == 0) { @@ -691,12 +694,16 @@ shm_mq_send_bytes(shm_mq_handle *mqh, Size nbytes, void *data, bool nowait, if (nowait) { if (shm_mq_get_receiver(mq) == NULL) + { + *bytes_written = sent; return SHM_MQ_WOULD_BLOCK; + } } else if (!shm_mq_wait_internal(mq, &mq->mq_receiver, mqh->mqh_handle)) { mq->mq_detached = true; + *bytes_written = sent; return SHM_MQ_DETACHED; } mqh->mqh_counterparty_attached = true; |