Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Skip to content

Commit 291e517

Browse files
michaelpqmichaelpq
committed
pageinspect: Add more sanity checks to prevent out-of-bound reads
A couple of code paths use the special area on the page passed by the function caller, expecting to find some data in it. However, feeding an incorrect page can lead to out-of-bound reads when trying to access the page special area (like a heap page that has no special area, leading PageGetSpecialPointer() to grab a pointer outside the allocated page). The functions used for hash and btree indexes have some protection already against that, while some other functions using a relation OID as argument would make sure that the access method involved is correct, but functions taking in input a raw page without knowing the relation the page is attached to would run into problems. This commit improves the set of checks used in the code paths of BRIN, btree (including one check if a leaf page is found with a non-zero level), GIN and GiST to verify that the page given in input has a special area size that fits with each access method, which is done though PageGetSpecialSize(), becore calling PageGetSpecialPointer(). The scope of the checks done is limited to work with pages that one would pass after getting a block with get_raw_page(), as it is possible to craft byteas that could bypass existing code paths. Having too many checks would also impact the usability of pageinspect, as the existing code is very useful to look at the content details in a corrupted page, so the focus is really to avoid out-of-bound reads as this is never a good thing even with functions whose execution is limited to superusers. The safest approach could be to rework the functions so as these fetch a block using a relation OID and a block number, but there are also cases where using a raw page is useful. Tests are added to cover all the code paths that needed such checks, and an error message for hash indexes is reworded to fit better with what this commit adds. Reported-By: Alexander Lakhin Author: Julien Rouhaud, Michael Paquier Discussion: https://postgr.es/m/16527-ef7606186f0610a1@postgresql.org Discussion: https://postgr.es/m/561e187b-3549-c8d5-03f5-525c14e65bd0@postgrespro.ru Backpatch-through: 10
1 parent 404f493 commit 291e517

15 files changed

+200
-30
lines changed

‎contrib/pageinspect/brinfuncs.c

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,15 @@ brin_page_type(PG_FUNCTION_ARGS)
5858

5959
page = get_page_from_raw(raw_page);
6060

61+
/* verify the special space has the expected size */
62+
if (PageGetSpecialSize(page) != MAXALIGN(sizeof(BrinSpecialSpace)))
63+
ereport(ERROR,
64+
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
65+
errmsg("input page is not a valid %s page", "BRIN"),
66+
errdetail("Expected special size %d, got %d.",
67+
(int) MAXALIGN(sizeof(BrinSpecialSpace)),
68+
(int) PageGetSpecialSize(page))));
69+
6170
switch (BrinPageType(page))
6271
{
6372
case BRIN_PAGETYPE_META:
@@ -86,6 +95,15 @@ verify_brin_page(bytea *raw_page, uint16 type, const char *strtype)
8695
{
8796
Page page = get_page_from_raw(raw_page);
8897

98+
/* verify the special space has the expected size */
99+
if (PageGetSpecialSize(page) != MAXALIGN(sizeof(BrinSpecialSpace)))
100+
ereport(ERROR,
101+
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
102+
errmsg("input page is not a valid %s page", "BRIN"),
103+
errdetail("Expected special size %d, got %d.",
104+
(int) MAXALIGN(sizeof(BrinSpecialSpace)),
105+
(int) PageGetSpecialSize(page))));
106+
89107
/* verify the special space says this page is what we want */
90108
if (BrinPageType(page) != type)
91109
ereport(ERROR,

‎contrib/pageinspect/btreefuncs.c

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -613,13 +613,27 @@ bt_page_items_bytea(PG_FUNCTION_ARGS)
613613

614614
uargs->offset = FirstOffsetNumber;
615615

616+
/* verify the special space has the expected size */
617+
if (PageGetSpecialSize(uargs->page) != MAXALIGN(sizeof(BTPageOpaqueData)))
618+
ereport(ERROR,
619+
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
620+
errmsg("input page is not a valid %s page", "btree"),
621+
errdetail("Expected special size %d, got %d.",
622+
(int) MAXALIGN(sizeof(BTPageOpaqueData)),
623+
(int) PageGetSpecialSize(uargs->page))));
624+
616625
opaque = (BTPageOpaque) PageGetSpecialPointer(uargs->page);
617626

618627
if (P_ISMETA(opaque))
619628
ereport(ERROR,
620629
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
621630
errmsg("block is a meta page")));
622631

632+
if (P_ISLEAF(opaque) && opaque->btpo_level != 0)
633+
ereport(ERROR,
634+
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
635+
errmsg("block is not a valid btree leaf page")));
636+
623637
if (P_ISDELETED(opaque))
624638
elog(NOTICE, "page is deleted");
625639

‎contrib/pageinspect/expected/brin.out

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,4 +52,14 @@ SELECT * FROM brin_page_items(get_raw_page('test1_a_idx', 2), 'test1_a_idx')
5252
CREATE INDEX test1_a_btree ON test1 (a);
5353
SELECT brin_page_items(get_raw_page('test1_a_btree', 0), 'test1_a_btree');
5454
ERROR: "test1_a_btree" is not a BRIN index
55+
-- Mask DETAIL messages as these are not portable across architectures.
56+
\set VERBOSITY terse
57+
-- Invalid special area size
58+
SELECT brin_page_type(get_raw_page('test1', 0));
59+
ERROR: input page is not a valid BRIN page
60+
SELECT * FROM brin_metapage_info(get_raw_page('test1', 0));
61+
ERROR: input page is not a valid BRIN page
62+
SELECT * FROM brin_revmap_data(get_raw_page('test1', 0));
63+
ERROR: input page is not a valid BRIN page
64+
\set VERBOSITY default
5565
DROP TABLE test1;

‎contrib/pageinspect/expected/btree.out

Lines changed: 18 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
CREATE TABLE test1 (a int8, b text);
2-
INSERT INTO test1 VALUES (72057594037927937, 'text');
1+
CREATE TABLE test1 (a int8, b int4range);
2+
INSERT INTO test1 VALUES (72057594037927937, '[0,1)');
33
CREATE INDEX test1_a_idx ON test1 USING btree (a);
44
\x
55
SELECT * FROM bt_metap('test1_a_idx');
@@ -78,11 +78,25 @@ SELECT bt_page_stats('test1_a_hash', 0);
7878
ERROR: "test1_a_hash" is not a btree index
7979
SELECT bt_page_items('test1_a_hash', 0);
8080
ERROR: "test1_a_hash" is not a btree index
81-
-- Failure with incorrect page size
81+
SELECT bt_page_items(get_raw_page('test1_a_hash', 0));
82+
ERROR: block is a meta page
83+
CREATE INDEX test1_b_gist ON test1 USING gist(b);
84+
-- Special area of GiST is the same as btree, this complains about inconsistent
85+
-- leaf data on the page.
86+
SELECT bt_page_items(get_raw_page('test1_b_gist', 0));
87+
ERROR: block is not a valid btree leaf page
88+
-- Several failure modes.
8289
-- Suppress the DETAIL message, to allow the tests to work across various
83-
-- page sizes.
90+
-- page sizes and architectures.
8491
\set VERBOSITY terse
92+
-- invalid page size
8593
SELECT bt_page_items('aaa'::bytea);
8694
ERROR: invalid page size
95+
-- invalid special area size
96+
CREATE INDEX test1_a_brin ON test1 USING brin(a);
97+
SELECT bt_page_items(get_raw_page('test1', 0));
98+
ERROR: input page is not a valid btree page
99+
SELECT bt_page_items(get_raw_page('test1_a_brin', 0));
100+
ERROR: input page is not a valid btree page
87101
\set VERBOSITY default
88102
DROP TABLE test1;

‎contrib/pageinspect/expected/gin.out

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -35,15 +35,23 @@ FROM gin_leafpage_items(get_raw_page('test1_y_idx',
3535
-[ RECORD 1 ]
3636
?column? | t
3737

38-
DROP TABLE test1;
39-
-- Failure with incorrect page size
38+
-- Failure with various modes.
4039
-- Suppress the DETAIL message, to allow the tests to work across various
41-
-- page sizes.
40+
-- page sizes and architectures.
4241
\set VERBOSITY terse
42+
-- invalid page size
4343
SELECT gin_leafpage_items('aaa'::bytea);
4444
ERROR: invalid page size
4545
SELECT gin_metapage_info('bbb'::bytea);
4646
ERROR: invalid page size
4747
SELECT gin_page_opaque_info('ccc'::bytea);
4848
ERROR: invalid page size
49+
-- invalid special area size
50+
SELECT * FROM gin_metapage_info(get_raw_page('test1', 0));
51+
ERROR: input page is not a valid GIN metapage
52+
SELECT * FROM gin_page_opaque_info(get_raw_page('test1', 0));
53+
ERROR: input page is not a valid GIN data leaf page
54+
SELECT * FROM gin_leafpage_items(get_raw_page('test1', 0));
55+
ERROR: input page is not a valid GIN data leaf page
4956
\set VERBOSITY default
57+
DROP TABLE test1;

‎contrib/pageinspect/expected/gist.out

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -68,15 +68,23 @@ SELECT itemoffset, ctid, itemlen FROM gist_page_items_bytea(get_raw_page('test_g
6868
CREATE INDEX test_gist_btree on test_gist(t);
6969
SELECT gist_page_items(get_raw_page('test_gist_btree', 0), 'test_gist_btree');
7070
ERROR: "test_gist_btree" is not a GiST index
71-
-- Failure with incorrect page size
71+
-- Failure with various modes.
7272
-- Suppress the DETAIL message, to allow the tests to work across various
73-
-- page sizes.
73+
-- page sizes and architectures.
7474
\set VERBOSITY terse
75+
-- invalid page size
7576
SELECT gist_page_items_bytea('aaa'::bytea);
7677
ERROR: invalid page size
7778
SELECT gist_page_items('aaa'::bytea, 'test_gist_idx'::regclass);
7879
ERROR: invalid page size
7980
SELECT gist_page_opaque_info('aaa'::bytea);
8081
ERROR: invalid page size
82+
-- invalid special area size
83+
SELECT * FROM gist_page_opaque_info(get_raw_page('test_gist', 0));
84+
ERROR: input page is not a valid GiST page
85+
SELECT gist_page_items_bytea(get_raw_page('test_gist', 0));
86+
ERROR: input page is not a valid GiST page
87+
SELECT gist_page_items_bytea(get_raw_page('test_gist_btree', 0));
88+
ERROR: input page is not a valid GiST page
8189
\set VERBOSITY default
8290
DROP TABLE test_gist;

‎contrib/pageinspect/expected/hash.out

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -167,10 +167,11 @@ ERROR: page is not a hash bucket or overflow page
167167
CREATE INDEX test_hash_a_btree ON test_hash USING btree (a);
168168
SELECT hash_bitmap_info('test_hash_a_btree', 0);
169169
ERROR: "test_hash_a_btree" is not a hash index
170-
-- Failure with incorrect page size
170+
-- Failure with various modes.
171171
-- Suppress the DETAIL message, to allow the tests to work across various
172-
-- page sizes.
172+
-- page sizes and architectures.
173173
\set VERBOSITY terse
174+
-- invalid page size
174175
SELECT hash_metapage_info('aaa'::bytea);
175176
ERROR: invalid page size
176177
SELECT hash_page_items('bbb'::bytea);
@@ -179,5 +180,14 @@ SELECT hash_page_stats('ccc'::bytea);
179180
ERROR: invalid page size
180181
SELECT hash_page_type('ddd'::bytea);
181182
ERROR: invalid page size
183+
-- invalid special area size
184+
SELECT hash_metapage_info(get_raw_page('test_hash', 0));
185+
ERROR: input page is not a valid hash page
186+
SELECT hash_page_items(get_raw_page('test_hash', 0));
187+
ERROR: input page is not a valid hash page
188+
SELECT hash_page_stats(get_raw_page('test_hash', 0));
189+
ERROR: input page is not a valid hash page
190+
SELECT hash_page_type(get_raw_page('test_hash', 0));
191+
ERROR: input page is not a valid hash page
182192
\set VERBOSITY default
183193
DROP TABLE test_hash;

‎contrib/pageinspect/ginfuncs.c

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,14 @@ gin_metapage_info(PG_FUNCTION_ARGS)
4949

5050
page = get_page_from_raw(raw_page);
5151

52+
if (PageGetSpecialSize(page) != MAXALIGN(sizeof(GinPageOpaqueData)))
53+
ereport(ERROR,
54+
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
55+
errmsg("input page is not a valid GIN metapage"),
56+
errdetail("Expected special size %d, got %d.",
57+
(int) MAXALIGN(sizeof(GinPageOpaqueData)),
58+
(int) PageGetSpecialSize(page))));
59+
5260
opaq = (GinPageOpaque) PageGetSpecialPointer(page);
5361
if (opaq->flags != GIN_META)
5462
ereport(ERROR,
@@ -107,6 +115,14 @@ gin_page_opaque_info(PG_FUNCTION_ARGS)
107115

108116
page = get_page_from_raw(raw_page);
109117

118+
if (PageGetSpecialSize(page) != MAXALIGN(sizeof(GinPageOpaqueData)))
119+
ereport(ERROR,
120+
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
121+
errmsg("input page is not a valid GIN data leaf page"),
122+
errdetail("Expected special size %d, got %d.",
123+
(int) MAXALIGN(sizeof(GinPageOpaqueData)),
124+
(int) PageGetSpecialSize(page))));
125+
110126
opaq = (GinPageOpaque) PageGetSpecialPointer(page);
111127

112128
/* Build a tuple descriptor for our result type */
@@ -188,9 +204,9 @@ gin_leafpage_items(PG_FUNCTION_ARGS)
188204
ereport(ERROR,
189205
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
190206
errmsg("input page is not a valid GIN data leaf page"),
191-
errdetail("Special size %d, expected %d",
192-
(int) PageGetSpecialSize(page),
193-
(int) MAXALIGN(sizeof(GinPageOpaqueData)))));
207+
errdetail("Expected special size %d, got %d.",
208+
(int) MAXALIGN(sizeof(GinPageOpaqueData)),
209+
(int) PageGetSpecialSize(page))));
194210

195211
opaq = (GinPageOpaque) PageGetSpecialPointer(page);
196212
if (opaq->flags != (GIN_DATA | GIN_LEAF | GIN_COMPRESSED))

‎contrib/pageinspect/gistfuncs.c

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,23 @@ gist_page_opaque_info(PG_FUNCTION_ARGS)
5555

5656
page = get_page_from_raw(raw_page);
5757

58+
/* verify the special space has the expected size */
59+
if (PageGetSpecialSize(page) != MAXALIGN(sizeof(GISTPageOpaqueData)))
60+
ereport(ERROR,
61+
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
62+
errmsg("input page is not a valid %s page", "GiST"),
63+
errdetail("Expected special size %d, got %d.",
64+
(int) MAXALIGN(sizeof(GISTPageOpaqueData)),
65+
(int) PageGetSpecialSize(page))));
66+
5867
opaq = (GISTPageOpaque) PageGetSpecialPointer(page);
68+
if (opaq->gist_page_id != GIST_PAGE_ID)
69+
ereport(ERROR,
70+
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
71+
errmsg("input page is not a valid %s page", "GiST"),
72+
errdetail("Expected %08x, got %08x.",
73+
GIST_PAGE_ID,
74+
opaq->gist_page_id)));
5975

6076
/* Build a tuple descriptor for our result type */
6177
if (get_call_result_type(fcinfo, NULL, &tupdesc) != TYPEFUNC_COMPOSITE)
@@ -101,6 +117,7 @@ gist_page_items_bytea(PG_FUNCTION_ARGS)
101117
bytea *raw_page = PG_GETARG_BYTEA_P(0);
102118
ReturnSetInfo *rsinfo = (ReturnSetInfo *) fcinfo->resultinfo;
103119
Page page;
120+
GISTPageOpaque opaq;
104121
OffsetNumber offset;
105122
OffsetNumber maxoff = InvalidOffsetNumber;
106123

@@ -113,6 +130,24 @@ gist_page_items_bytea(PG_FUNCTION_ARGS)
113130

114131
page = get_page_from_raw(raw_page);
115132

133+
/* verify the special space has the expected size */
134+
if (PageGetSpecialSize(page) != MAXALIGN(sizeof(GISTPageOpaqueData)))
135+
ereport(ERROR,
136+
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
137+
errmsg("input page is not a valid %s page", "GiST"),
138+
errdetail("Expected special size %d, got %d.",
139+
(int) MAXALIGN(sizeof(GISTPageOpaqueData)),
140+
(int) PageGetSpecialSize(page))));
141+
142+
opaq = (GISTPageOpaque) PageGetSpecialPointer(page);
143+
if (opaq->gist_page_id != GIST_PAGE_ID)
144+
ereport(ERROR,
145+
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
146+
errmsg("input page is not a valid %s page", "GiST"),
147+
errdetail("Expected %08x, got %08x.",
148+
GIST_PAGE_ID,
149+
opaq->gist_page_id)));
150+
116151
/* Avoid bogus PageGetMaxOffsetNumber() call with deleted pages */
117152
if (GistPageIsDeleted(page))
118153
elog(NOTICE, "page is deleted");

‎contrib/pageinspect/hashfuncs.c

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -66,14 +66,17 @@ verify_hash_page(bytea *raw_page, int flags)
6666

6767
if (PageGetSpecialSize(page) != MAXALIGN(sizeof(HashPageOpaqueData)))
6868
ereport(ERROR,
69-
(errcode(ERRCODE_INDEX_CORRUPTED),
70-
errmsg("index table contains corrupted page")));
69+
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
70+
errmsg("input page is not a valid %s page", "hash"),
71+
errdetail("Expected special size %d, got %d.",
72+
(int) MAXALIGN(sizeof(HashPageOpaqueData)),
73+
(int) PageGetSpecialSize(page))));
7174

7275
pageopaque = (HashPageOpaque) PageGetSpecialPointer(page);
7376
if (pageopaque->hasho_page_id != HASHO_PAGE_ID)
7477
ereport(ERROR,
7578
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
76-
errmsg("page is not a hash page"),
79+
errmsg("input page is not a valid %s page", "hash"),
7780
errdetail("Expected %08x, got %08x.",
7881
HASHO_PAGE_ID, pageopaque->hasho_page_id)));
7982

@@ -134,7 +137,7 @@ verify_hash_page(bytea *raw_page, int flags)
134137
ereport(ERROR,
135138
(errcode(ERRCODE_INDEX_CORRUPTED),
136139
errmsg("invalid version for metadata"),
137-
errdetail("Expected %d, got %d",
140+
errdetail("Expected %d, got %d.",
138141
HASH_VERSION, metap->hashm_version)));
139142
}
140143

‎contrib/pageinspect/sql/brin.sql

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,4 +19,12 @@ SELECT * FROM brin_page_items(get_raw_page('test1_a_idx', 2), 'test1_a_idx')
1919
CREATE INDEX test1_a_btree ON test1 (a);
2020
SELECT brin_page_items(get_raw_page('test1_a_btree', 0), 'test1_a_btree');
2121

22+
-- Mask DETAIL messages as these are not portable across architectures.
23+
\set VERBOSITY terse
24+
-- Invalid special area size
25+
SELECT brin_page_type(get_raw_page('test1', 0));
26+
SELECT * FROM brin_metapage_info(get_raw_page('test1', 0));
27+
SELECT * FROM brin_revmap_data(get_raw_page('test1', 0));
28+
\set VERBOSITY default
29+
2230
DROP TABLE test1;

‎contrib/pageinspect/sql/btree.sql

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
CREATE TABLE test1 (a int8, b text);
2-
INSERT INTO test1 VALUES (72057594037927937, 'text');
1+
CREATE TABLE test1 (a int8, b int4range);
2+
INSERT INTO test1 VALUES (72057594037927937, '[0,1)');
33
CREATE INDEX test1_a_idx ON test1 USING btree (a);
44

55
\x
@@ -26,12 +26,22 @@ CREATE INDEX test1_a_hash ON test1 USING hash(a);
2626
SELECT bt_metap('test1_a_hash');
2727
SELECT bt_page_stats('test1_a_hash', 0);
2828
SELECT bt_page_items('test1_a_hash', 0);
29+
SELECT bt_page_items(get_raw_page('test1_a_hash', 0));
30+
CREATE INDEX test1_b_gist ON test1 USING gist(b);
31+
-- Special area of GiST is the same as btree, this complains about inconsistent
32+
-- leaf data on the page.
33+
SELECT bt_page_items(get_raw_page('test1_b_gist', 0));
2934

30-
-- Failure with incorrect page size
35+
-- Several failure modes.
3136
-- Suppress the DETAIL message, to allow the tests to work across various
32-
-- page sizes.
37+
-- page sizes and architectures.
3338
\set VERBOSITY terse
39+
-- invalid page size
3440
SELECT bt_page_items('aaa'::bytea);
41+
-- invalid special area size
42+
CREATE INDEX test1_a_brin ON test1 USING brin(a);
43+
SELECT bt_page_items(get_raw_page('test1', 0));
44+
SELECT bt_page_items(get_raw_page('test1_a_brin', 0));
3545
\set VERBOSITY default
3646

3747
DROP TABLE test1;

‎contrib/pageinspect/sql/gin.sql

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,13 +18,18 @@ FROM gin_leafpage_items(get_raw_page('test1_y_idx',
1818
(pg_relation_size('test1_y_idx') /
1919
current_setting('block_size')::bigint)::int - 1));
2020

21-
DROP TABLE test1;
22-
23-
-- Failure with incorrect page size
21+
-- Failure with various modes.
2422
-- Suppress the DETAIL message, to allow the tests to work across various
25-
-- page sizes.
23+
-- page sizes and architectures.
2624
\set VERBOSITY terse
25+
-- invalid page size
2726
SELECT gin_leafpage_items('aaa'::bytea);
2827
SELECT gin_metapage_info('bbb'::bytea);
2928
SELECT gin_page_opaque_info('ccc'::bytea);
29+
-- invalid special area size
30+
SELECT * FROM gin_metapage_info(get_raw_page('test1', 0));
31+
SELECT * FROM gin_page_opaque_info(get_raw_page('test1', 0));
32+
SELECT * FROM gin_leafpage_items(get_raw_page('test1', 0));
3033
\set VERBOSITY default
34+
35+
DROP TABLE test1;

0 commit comments

Comments
 (0)