Don't read fields of a misaligned ExpandedObjectHeader or AnyArrayType.

UBSan complains about this.  Instead, cast to a suitable type requiring
only 4-byte alignment.  DatumGetAnyArrayP() already assumes one can cast
between AnyArrayType and ArrayType, so this doesn't introduce a new
assumption.  Back-patch to 9.5, where AnyArrayType was introduced.

Reviewed by Tom Lane.

Discussion: https://postgr.es/m/20190629210334.GA1244217@rfd.leadboat.com

diff --git a/src/backend/utils/adt/arrayfuncs.c b/src/backend/utils/adt/arrayfuncs.c
index caac4c3c4f0c54b1c3ae0cfb2750895b14073dd8..43ff1d7803dd5bdf5f56a643dd6319d7bffc826b 100644 (file)
--- a/src/backend/utils/adt/arrayfuncs.c
+++ b/src/backend/utils/adt/arrayfuncs.c
@@ -4108,7 +4108,7 @@ array_contain_compare(AnyArrayType *array1, AnyArrayType *array2, Oid collation,
        nelems2 = array2->xpn.nelems;
    }
    else
-       deconstruct_array(&(array2->flt),
+       deconstruct_array((ArrayType *) array2,
                          element_type, typlen, typbyval, typalign,
                          &values2, &nulls2, &nelems2);
 

diff --git a/src/include/utils/array.h b/src/include/utils/array.h
index 6164f119ba766349e14cf055a14664029fa344ce..9fd34c6272fd0345c8aef60db7b24231f1f8e70d 100644 (file)
--- a/src/include/utils/array.h
+++ b/src/include/utils/array.h
@@ -153,7 +153,10 @@ typedef struct ExpandedArrayHeader
 
 /*
  * Functions that can handle either a "flat" varlena array or an expanded
- * array use this union to work with their input.
+ * array use this union to work with their input.  Don't refer to "flt";
+ * instead, cast to ArrayType.  This struct nominally requires 8-byte
+ * alignment on 64-bit, but it's often used for an ArrayType having 4-byte
+ * alignment.  UBSan complains about referencing "flt" in such cases.
  */
 typedef union AnyArrayType
 {
@@ -307,17 +310,21 @@ typedef struct ArrayIteratorData *ArrayIterator;
  * Macros for working with AnyArrayType inputs.  Beware multiple references!
  */
 #define AARR_NDIM(a) \
-   (VARATT_IS_EXPANDED_HEADER(a) ? (a)->xpn.ndims : ARR_NDIM(&(a)->flt))
+   (VARATT_IS_EXPANDED_HEADER(a) ? \
+    (a)->xpn.ndims : ARR_NDIM((ArrayType *) (a)))
 #define AARR_HASNULL(a) \
    (VARATT_IS_EXPANDED_HEADER(a) ? \
     ((a)->xpn.dvalues != NULL ? (a)->xpn.dnulls != NULL : ARR_HASNULL((a)->xpn.fvalue)) : \
-    ARR_HASNULL(&(a)->flt))
+    ARR_HASNULL((ArrayType *) (a)))
 #define AARR_ELEMTYPE(a) \
-   (VARATT_IS_EXPANDED_HEADER(a) ? (a)->xpn.element_type : ARR_ELEMTYPE(&(a)->flt))
+   (VARATT_IS_EXPANDED_HEADER(a) ? \
+    (a)->xpn.element_type : ARR_ELEMTYPE((ArrayType *) (a)))
 #define AARR_DIMS(a) \
-   (VARATT_IS_EXPANDED_HEADER(a) ? (a)->xpn.dims : ARR_DIMS(&(a)->flt))
+   (VARATT_IS_EXPANDED_HEADER(a) ? \
+    (a)->xpn.dims : ARR_DIMS((ArrayType *) (a)))
 #define AARR_LBOUND(a) \
-   (VARATT_IS_EXPANDED_HEADER(a) ? (a)->xpn.lbound : ARR_LBOUND(&(a)->flt))
+   (VARATT_IS_EXPANDED_HEADER(a) ? \
+    (a)->xpn.lbound : ARR_LBOUND((ArrayType *) (a)))
 
 
 /*

diff --git a/src/include/utils/arrayaccess.h b/src/include/utils/arrayaccess.h
index 3ff49f12bc4a5c884e972aa4f375b0d313147d7c..ae6d88d2c0d56641ceaaa3f3e9e982b629c1f18e 100644 (file)
--- a/src/include/utils/arrayaccess.h
+++ b/src/include/utils/arrayaccess.h
@@ -71,8 +71,8 @@ array_iter_setup(array_iter *it, AnyArrayType *a)
    {
        it->datumptr = NULL;
        it->isnullptr = NULL;
-       it->dataptr = ARR_DATA_PTR(&a->flt);
-       it->bitmapptr = ARR_NULLBITMAP(&a->flt);
+       it->dataptr = ARR_DATA_PTR((ArrayType *) a);
+       it->bitmapptr = ARR_NULLBITMAP((ArrayType *) a);
    }
    it->bitmask = 1;
 }

diff --git a/src/include/utils/expandeddatum.h b/src/include/utils/expandeddatum.h
index 47989a8cf204b3abc276c97fcdbde672898e96cb..fb91c4a40781fceafe327e9b122694e49cb604fc 100644 (file)
--- a/src/include/utils/expandeddatum.h
+++ b/src/include/utils/expandeddatum.h
@@ -126,7 +126,7 @@ struct ExpandedObjectHeader
  */
 #define EOH_HEADER_MAGIC (-1)
 #define VARATT_IS_EXPANDED_HEADER(PTR) \
-   (((ExpandedObjectHeader *) (PTR))->vl_len_ == EOH_HEADER_MAGIC)
+   (((varattrib_4b *) (PTR))->va_4byte.va_header == EOH_HEADER_MAGIC)
 
 /*
  * Generic support functions for expanded objects.