mirror of
https://git.postgresql.org/git/postgresql.git
synced 2026-02-25 15:57:02 +08:00
e0c3d5122e
This function called generate_series() without enforcing its input argument types, making possible for an attacker to catch this call, by defining for example a generate_series(int,bigint). The internals of pg_freespace(regclass) are changed to force the use of bigint for the inputs of generate_series(). A more consistent style is applied for all its hardcoded values, while on it. Issue introduced in 3f323eba89fb. Reported-by: Noah Misch Reviewed-by: Noah Misch Discussion: https://postgr.es/m/20250106190428.ec.nmisch@google.com
14 lines
554 B
SQL
14 lines
554 B
SQL
/* contrib/pg_freespacemap/pg_freespacemap--1.2--1.3.sql */
|
|
|
|
-- complain if script is sourced in psql, rather than via ALTER EXTENSION
|
|
\echo Use "ALTER EXTENSION pg_freespacemap UPDATE TO '1.3'" to load this file. \quit
|
|
|
|
CREATE OR REPLACE FUNCTION
|
|
pg_freespace(rel regclass, blkno OUT bigint, avail OUT int2)
|
|
RETURNS SETOF RECORD
|
|
LANGUAGE SQL PARALLEL SAFE
|
|
BEGIN ATOMIC
|
|
SELECT blkno, pg_freespace($1, blkno) AS avail
|
|
FROM generate_series('0'::bigint, pg_relation_size($1) / current_setting('block_size'::text)::bigint - '1'::bigint) AS blkno;
|
|
END;
|