Fix crash bug in RestoreSnapshot.

robertmhaas · robertmhaas · commit 4f9f495889d3 · 2016-07-01T09:04:11.000-04:00
If serialized_snapshot-&gt;subxcnt &gt; 0 and serialized_snapshot-&gt;xcnt == 0,
the old coding would do the wrong thing and crash.  This can happen
on standby servers.

Report by Andreas Seltenreich.  Patch by Thomas Munro, reviewed by
Amit Kapila and tested by Andreas Seltenreich.
diff --git a/src/backend/utils/time/snapmgr.c b/src/backend/utils/time/snapmgr.c
@@ -2016,7 +2016,8 @@ RestoreSnapshot(char *start_address)
 	/* Copy SubXIDs, if present. */
 	if (serialized_snapshot->subxcnt > 0)
 	{
-		snapshot->subxip = snapshot->xip + serialized_snapshot->xcnt;
+		snapshot->subxip = ((TransactionId *) (snapshot + 1)) +
+			serialized_snapshot->xcnt;
 		memcpy(snapshot->subxip, serialized_xids + serialized_snapshot->xcnt,
 			   serialized_snapshot->subxcnt * sizeof(TransactionId));
 	}

Original file line number	Diff line number	Diff line change
`@@ -2016,7 +2016,8 @@ RestoreSnapshot(char *start_address)`
`2016`	`2016`	`/* Copy SubXIDs, if present. */`
`2017`	`2017`	`if (serialized_snapshot->subxcnt > 0)`
`2018`	`2018`	`{`
`2019`		`- snapshot->subxip = snapshot->xip + serialized_snapshot->xcnt;`
	`2019`	`+ snapshot->subxip = ((TransactionId *) (snapshot + 1)) +`
	`2020`	`+ serialized_snapshot->xcnt;`
`2020`	`2021`	`memcpy(snapshot->subxip, serialized_xids + serialized_snapshot->xcnt,`
`2021`	`2022`	`serialized_snapshot->subxcnt * sizeof(TransactionId));`
`2022`	`2023`	`}`