Fix memory overrun when querying pg_stat_slru

pg_stat_get_slru() in pgstatfuncs.c would point to one element after the
end of the array PgStat_SLRUStats when finishing to scan its entries.
This had no direct consequences as no data from the extra memory area
was read, but static analyzers would rightfully complain here.  So let's
be clean.

While on it, this adds one regression test in the area reserved for
system views.

Reported-by: Alexander Kozhemyakin, via AddressSanitizer
Author: Kyotaro Horiguchi
Discussion: https://postgr.es/m/17280-37da556e86032070@postgresql.org
Backpatch-through: 13

diff --git a/src/backend/utils/adt/pgstatfuncs.c b/src/backend/utils/adt/pgstatfuncs.c
index 95738a4e34eecb2992442d299031b8d243d86d3e..443dab3564ad46384cbafa713588d85f34fb1141 100644 (file)
--- a/src/backend/utils/adt/pgstatfuncs.c
+++ b/src/backend/utils/adt/pgstatfuncs.c
@@ -1744,7 +1744,7 @@ pg_stat_get_slru(PG_FUNCTION_ARGS)
        /* for each row */
        Datum       values[PG_STAT_GET_SLRU_COLS];
        bool        nulls[PG_STAT_GET_SLRU_COLS];
-       PgStat_SLRUStats stat = stats[i];
+       PgStat_SLRUStats stat;
        const char *name;
 
        name = pgstat_slru_name(i);
@@ -1752,6 +1752,7 @@ pg_stat_get_slru(PG_FUNCTION_ARGS)
        if (!name)
            break;
 
+       stat = stats[i];
        MemSet(values, 0, sizeof(values));
        MemSet(nulls, 0, sizeof(nulls));
 

diff --git a/src/test/regress/expected/sysviews.out b/src/test/regress/expected/sysviews.out
index c3b988597c62df1594aecfffaaba1dd089297f7e..294c2c18faa68b0864804ad5b6cb5a89843f0cae 100644 (file)
--- a/src/test/regress/expected/sysviews.out
+++ b/src/test/regress/expected/sysviews.out
@@ -67,6 +67,13 @@ select count(*) >= 0 as ok from pg_prepared_xacts;
  t
 (1 row)
 
+-- There will surely be at least one SLRU cache
+select count(*) > 0 as ok from pg_stat_slru;
+ ok 
+----
+ t
+(1 row)
+
 -- We expect no walreceiver running in this test
 select count(*) = 0 as ok from pg_stat_wal_receiver;
  ok 

diff --git a/src/test/regress/sql/sysviews.sql b/src/test/regress/sql/sysviews.sql
index 5eb111d3fda148c957f75e7a07adce6b7dc9c7fc..e0ddb114858c11f1f1daf1ca71f9bfc989f2292c 100644 (file)
--- a/src/test/regress/sql/sysviews.sql
+++ b/src/test/regress/sql/sysviews.sql
@@ -32,6 +32,9 @@ select count(*) = 0 as ok from pg_prepared_statements;
 -- See also prepared_xacts.sql
 select count(*) >= 0 as ok from pg_prepared_xacts;
 
+-- There will surely be at least one SLRU cache
+select count(*) > 0 as ok from pg_stat_slru;
+
 -- We expect no walreceiver running in this test
 select count(*) = 0 as ok from pg_stat_wal_receiver;