Fix buffer overflow in writeHashEntry()
MAXALIGN(datum_size) can be greater than BUFFER_INCREMENT_SIZE, hence
when allocating the buffer need to make sure buffer has enough space
for writing the next datum.
@@ -1636,11 +1636,13 @@ writeHashEntry(AggState *aggstate, BatchFileInfo *file_info,
if ((aggDataOffset + MAXALIGN(datum_size)) >= aggDataBufferSize)
{
- aggDataBufferSize += BUFFER_INCREMENT_SIZE;
+ aggDataBufferSize += MAXALIGN(datum_size) >= BUFFER_INCREMENT_SIZE ?
+ MAXALIGN(datum_size) + BUFFER_INCREMENT_SIZE : BUFFER_INCREMENT_SIZE;
MemoryContext oldAggContext = MemoryContextSwitchTo(TopMemoryContext);
aggDataBuffer = repalloc(aggDataBuffer, aggDataBufferSize);
MemoryContextSwitchTo(oldAggContext);
}
+ Assert((aggDataOffset + MAXALIGN(datum_size)) <= aggDataBufferSize);
memcpy((aggDataBuffer + aggDataOffset), datum_value, datum_size);
aggDataOffset += MAXALIGN(datum_size);
