Prevent shm_mq_send from reading uninitialized memory.

robertmhaas · robertmhaas · commit 1144ea3421e4 · 2014-07-24T09:23:22.000-04:00
shm_mq_send_bytes didn't invariably initialize *bytes_written before
returning, which would cause shm_mq_send to read from uninitialized
memory and add the value it found there to mqh-&gt;mqh_partial_bytes.
This could cause the next attempt to send a message via the queue to
fail an assertion (if the queue was detached) or copy data from a
garbage pointer value into the queue (if non-blocking mode was in use).
diff --git a/src/backend/storage/ipc/shm_mq.c b/src/backend/storage/ipc/shm_mq.c
@@ -676,7 +676,10 @@ shm_mq_send_bytes(shm_mq_handle *mqh, Size nbytes, void *data, bool nowait,
 
 		/* Bail out if the queue has been detached. */
 		if (detached)
+		{
+			*bytes_written = sent;
 			return SHM_MQ_DETACHED;
+		}
 
 		if (available == 0)
 		{
@@ -691,12 +694,16 @@ shm_mq_send_bytes(shm_mq_handle *mqh, Size nbytes, void *data, bool nowait,
 				if (nowait)
 				{
 					if (shm_mq_get_receiver(mq) == NULL)
+					{
+						*bytes_written = sent;
 						return SHM_MQ_WOULD_BLOCK;
+					}
 				}
 				else if (!shm_mq_wait_internal(mq, &mq->mq_receiver,
 											   mqh->mqh_handle))
 				{
 					mq->mq_detached = true;
+					*bytes_written = sent;
 					return SHM_MQ_DETACHED;
 				}
 				mqh->mqh_counterparty_attached = true;

Original file line number	Diff line number	Diff line change
`@@ -676,7 +676,10 @@ shm_mq_send_bytes(shm_mq_handle mqh, Size nbytes, void data, bool nowait,`
`676`	`676`
`677`	`677`	`/* Bail out if the queue has been detached. */`
`678`	`678`	`if (detached)`
	`679`	`+ {`
	`680`	`+ *bytes_written = sent;`
`679`	`681`	`return SHM_MQ_DETACHED;`
	`682`	`+ }`
`680`	`683`
`681`	`684`	`if (available == 0)`
`682`	`685`	`{`
`@@ -691,12 +694,16 @@ shm_mq_send_bytes(shm_mq_handle mqh, Size nbytes, void data, bool nowait,`
`691`	`694`	`if (nowait)`
`692`	`695`	`{`
`693`	`696`	`if (shm_mq_get_receiver(mq) == NULL)`
	`697`	`+ {`
	`698`	`+ *bytes_written = sent;`
`694`	`699`	`return SHM_MQ_WOULD_BLOCK;`
	`700`	`+ }`
`695`	`701`	`}`
`696`	`702`	`else if (!shm_mq_wait_internal(mq, &mq->mq_receiver,`
`697`	`703`	`mqh->mqh_handle))`
`698`	`704`	`{`
`699`	`705`	`mq->mq_detached = true;`
	`706`	`+ *bytes_written = sent;`
`700`	`707`	`return SHM_MQ_DETACHED;`
`701`	`708`	`}`
`702`	`709`	`mqh->mqh_counterparty_attached = true;`