Fix overflow in Windows replacement pg_pread/pg_pwrite.

macdice · macdice · commit 1e013746544b · 2024-03-03T08:40:41.000+13:00
When calling the Windows file I/O APIs there is an implicit conversion from size_t to DWORD, which could overflow. Clamp the size at 1GB to avoid that. Not a really a live bug as we don't expect anything in PostgreSQL to call with such large values. Reviewed-by: Peter Eisentraut <peter@eisentraut.org> Discussion: https://postgr.es/m/1672202.1703441340%40sss.pgh.pa.us
diff --git a/src/port/win32pread.c b/src/port/win32pread.c
@@ -30,6 +30,9 @@ pg_pread(int fd, void *buf, size_t size, off_t offset)
 		return -1;
 	}
 
+	/* Avoid overflowing DWORD. */
+	size = Min(size, 1024 * 1024 * 1024);
+
 	/* Note that this changes the file position, despite not using it. */
 	overlapped.Offset = offset;
 	if (!ReadFile(handle, buf, size, &result, &overlapped))
diff --git a/src/port/win32pwrite.c b/src/port/win32pwrite.c
@@ -30,6 +30,9 @@ pg_pwrite(int fd, const void *buf, size_t size, off_t offset)
 		return -1;
 	}
 
+	/* Avoid overflowing DWORD. */
+	size = Min(size, 1024 * 1024 * 1024);
+
 	/* Note that this changes the file position, despite not using it. */
 	overlapped.Offset = offset;
 	if (!WriteFile(handle, buf, size, &result, &overlapped))

Original file line number	Diff line number	Diff line change
`@@ -30,6 +30,9 @@ pg_pread(int fd, void *buf, size_t size, off_t offset)`
`30`	`30`	`return -1;`
`31`	`31`	`}`
`32`	`32`
	`33`	`+ /* Avoid overflowing DWORD. */`
	`34`	`+ size = Min(size, 1024 * 1024 * 1024);`
	`35`	`+`
`33`	`36`	`/* Note that this changes the file position, despite not using it. */`
`34`	`37`	`overlapped.Offset = offset;`
`35`	`38`	`if (!ReadFile(handle, buf, size, &result, &overlapped))`
Original file line number	Diff line number	Diff line change
`@@ -30,6 +30,9 @@ pg_pwrite(int fd, const void *buf, size_t size, off_t offset)`
`30`	`30`	`return -1;`
`31`	`31`	`}`
`32`	`32`
	`33`	`+ /* Avoid overflowing DWORD. */`
	`34`	`+ size = Min(size, 1024 * 1024 * 1024);`
	`35`	`+`
`33`	`36`	`/* Note that this changes the file position, despite not using it. */`
`34`	`37`	`overlapped.Offset = offset;`
`35`	`38`	`if (!WriteFile(handle, buf, size, &result, &overlapped))`