Skip to content

Fix segfault in large packets#995

Open
GorComComputing wants to merge 1 commit intoyandex:masterfrom
GorComComputing:Fix-segfault-in-large-packets
Open

Fix segfault in large packets#995
GorComComputing wants to merge 1 commit intoyandex:masterfrom
GorComComputing:Fix-segfault-in-large-packets

Conversation

@GorComComputing
Copy link

The segfault occurs due to a signed integer overflow (it becomes negative).
The integer overflow happens when the size of a received PostgreSQL protocol packet exceeds 0x80000000 (2 GB).

In the PostgreSQL wire protocol, the packet size is specified as a 4-byte integer, which theoretically allows sending packets up to 4 GB in size.
However, in practice, the Postgres server allocates memory blocks of up to 1 GB:

#define MaxAllocSize    ((Size) 0x3fffffff)

When receiving a packet, the server checks its length value, and if it exceeds 1 GB (0x3fffffff), it stops processing the packet and returns an error:

invalid message length

Therefore, to fix the segfault, it was decided to add a handler that ensures the packet size does not exceed 0x80000000 (2 GB).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant