MIME-Version: 1.0
From: Varik Matevosyan <varikmatevosyan@gmail.com>
Date: Sun, 17 May 2026 02:30:00 +0400
Message-ID: 
 <CA+bBoog3cCogktzfLb9bppUByu-10B3CFp8u=iKXG_OvtAguCw@mail.gmail.com>
Subject: [PATCH] Replace debug-only Asserts with runtime checks in logical
 replication apply worker
To: pgsql-bugs@lists.postgresql.org
Cc: Noah Misch <noah@leadboat.com>
Content-Type: multipart/mixed; boundary="000000000000eb13ac0651f6df05"
Archived-At: 
 <https://www.postgresql.org/message-id/CA%2BbBoog3cCogktzfLb9bppUByu-10B3CFp8u%3DiKXG_OvtAguCw%40mail.gmail.com>
Precedence: bulk

--000000000000eb13ac0651f6df05
Content-Type: text/plain; charset="UTF-8"

The attached patch replaces three debug-only Asserts with runtime
ereport(ERROR, ERRCODE_PROTOCOL_VIOLATION) checks in the logical
replication apply worker (worker.c). These guard against a mismatch
between the column count in the RELATION message and the count in a
subsequent INSERT/UPDATE/DELETE tuple message.

A publisher can send a RELATION claiming N columns and
an INSERT claiming M < N columns, causing the subscriber
to index past the end of the tuple's colvalues[]/colstatus[] arrays.

I believe this is more of a correctness fix than a security issue as
the attacker needs replication privileges, and in my testing I was not
able to trigger a SIGSEGV, the OOB read landed on heap bytes that
happened to not cause a crash.

P.S: After a security review from Noah, I'm reporting this as a bug.

Thanks,
Varik

--000000000000eb13ac0651f6df05
Content-Type: application/octet-stream;
	name="0001-Replace-debug-only-Asserts-with-runtime-checks-in-lo.patch"
Content-Disposition: attachment;
	filename="0001-Replace-debug-only-Asserts-with-runtime-checks-in-lo.patch"
Content-Transfer-Encoding: base64
Content-ID: <f_mp80b4c40>
X-Attachment-Id: f_mp80b4c40

RnJvbSBmNzY5NWJhZWQ0MGU1YmIyMDZkN2U0MjkxMGVhZjAzNDhiN2ZkYmFjIE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiBWYXJpayBNYXRldm9zeWFuIDx2YXJpa21hdGV2b3N5YW5AZ21h
aWwuY29tPgpEYXRlOiBNb24sIDQgTWF5IDIwMjYgMTQ6MzM6MDkgKzAwMDAKU3ViamVjdDogW1BB
VENIXSBSZXBsYWNlIGRlYnVnLW9ubHkgQXNzZXJ0cyB3aXRoIHJ1bnRpbWUgY2hlY2tzIGluIGxv
Z2ljYWwKIHJlcGxpY2F0aW9uIGFwcGx5IHdvcmtlcgoKVGhyZWUgbG9jYXRpb25zIGluIHdvcmtl
ci5jIHVzZSBBc3NlcnQoKSB0byBndWFyZCBhZ2FpbnN0IGEgbWlzbWF0Y2gKYmV0d2VlbiB0aGUg
bnVtYmVyIG9mIGNvbHVtbnMgYWR2ZXJ0aXNlZCBpbiB0aGUgUkVMQVRJT04gbWVzc2FnZSBhbmQK
dGhlIG51bWJlciBhY3R1YWxseSByZWNlaXZlZCBpbiB0aGUgc3Vic2VxdWVudCBJTlNFUlQvVVBE
QVRFIHR1cGxlCm1lc3NhZ2UuIFNpbmNlIHRoZXNlIHZhbHVlcyBvcmlnaW5hdGUgZnJvbSB0aGUg
cHVibGlzaGVyLCB0aGUgY2hlY2sKbXVzdCBzdXJ2aXZlIGludG8gcHJvZHVjdGlvbiBidWlsZHMu
CgpBIG1hbGljaW91cyBvciBidWdneSBwdWJsaXNoZXIgY2FuIHNlbmQgYSBSRUxBVElPTiBjbGFp
bWluZyBOIGNvbHVtbnMKYW5kIGFuIElOU0VSVCBjbGFpbWluZyBNIDwgTiBjb2x1bW5zLiBUaGUg
c3Vic2NyaWJlcidzIGFwcGx5IHdvcmtlcgppbmRleGVzIGludG8gY29sdmFsdWVzW10vY29sc3Rh
dHVzW10gdXNpbmcgY29sdW1uIGluZGljZXMgZnJvbSB0aGUKUkVMQVRJT04gbWVzc2FnZSdzIGF0
dHJpYnV0ZSBtYXAsIGNhdXNpbmcgYSBoZWFwIG91dC1vZi1ib3VuZHMgcmVhZAp3aGVuIHRoZSB0
dXBsZSdzIGNvbHVtbiBhcnJheSBpcyBzbWFsbGVyIHRoYW4gZXhwZWN0ZWQuCgpSZXBsYWNlIHRo
ZSBBc3NlcnRzIHdpdGggZXJlcG9ydChFUlJPUiwgRVJSQ09ERV9QUk9UT0NPTF9WSU9MQVRJT04p
CnRoYXQgcHJvZHVjZXMgYSBjbGVhciBkaWFnbm9zdGljIGFuZCBjbGVhbmx5IGFib3J0cyB0aGUg
dHJhbnNhY3Rpb24uCi0tLQogc3JjL2JhY2tlbmQvcmVwbGljYXRpb24vbG9naWNhbC93b3JrZXIu
YyB8IDIzICsrKysrKysrKysrKysrKysrKystLS0tCiAxIGZpbGUgY2hhbmdlZCwgMTkgaW5zZXJ0
aW9ucygrKSwgNCBkZWxldGlvbnMoLSkKCmRpZmYgLS1naXQgYS9zcmMvYmFja2VuZC9yZXBsaWNh
dGlvbi9sb2dpY2FsL3dvcmtlci5jIGIvc3JjL2JhY2tlbmQvcmVwbGljYXRpb24vbG9naWNhbC93
b3JrZXIuYwppbmRleCBkZDZmYzM4YTQxZS4uYTNmMjQwNmVkODMgMTAwNjQ0Ci0tLSBhL3NyYy9i
YWNrZW5kL3JlcGxpY2F0aW9uL2xvZ2ljYWwvd29ya2VyLmMKKysrIGIvc3JjL2JhY2tlbmQvcmVw
bGljYXRpb24vbG9naWNhbC93b3JrZXIuYwpAQCAtMTAzOCw5ICsxMDM4LDE1IEBAIHNsb3Rfc3Rv
cmVfZGF0YShUdXBsZVRhYmxlU2xvdCAqc2xvdCwgTG9naWNhbFJlcFJlbE1hcEVudHJ5ICpyZWws
CiAKIAkJaWYgKCFhdHQtPmF0dGlzZHJvcHBlZCAmJiByZW1vdGVhdHRudW0gPj0gMCkKIAkJewot
CQkJU3RyaW5nSW5mbwljb2x2YWx1ZSA9ICZ0dXBsZURhdGEtPmNvbHZhbHVlc1tyZW1vdGVhdHRu
dW1dOworCQkJU3RyaW5nSW5mbwljb2x2YWx1ZTsKKworCQkJaWYgKHJlbW90ZWF0dG51bSA+PSB0
dXBsZURhdGEtPm5jb2xzKQorCQkJCWVyZXBvcnQoRVJST1IsCisJCQkJCQkoZXJyY29kZShFUlJD
T0RFX1BST1RPQ09MX1ZJT0xBVElPTiksCisJCQkJCQkgZXJybXNnKCJsb2dpY2FsIHJlcGxpY2F0
aW9uIGNvbHVtbiAlZCBub3QgZm91bmQgaW4gdHVwbGU6IG9ubHkgJWQgY29sdW1uKHMpIHJlY2Vp
dmVkIiwKKwkJCQkJCQkJcmVtb3RlYXR0bnVtICsgMSwgdHVwbGVEYXRhLT5uY29scykpKTsKIAot
CQkJQXNzZXJ0KHJlbW90ZWF0dG51bSA8IHR1cGxlRGF0YS0+bmNvbHMpOworCQkJY29sdmFsdWUg
PSAmdHVwbGVEYXRhLT5jb2x2YWx1ZXNbcmVtb3RlYXR0bnVtXTsKIAogCQkJLyogU2V0IGF0dG51
bSBmb3IgZXJyb3IgY2FsbGJhY2sgKi8KIAkJCWFwcGx5X2Vycm9yX2NhbGxiYWNrX2FyZy5yZW1v
dGVfYXR0bnVtID0gcmVtb3RlYXR0bnVtOwpAQCAtMTE1MSw3ICsxMTU3LDExIEBAIHNsb3RfbW9k
aWZ5X2RhdGEoVHVwbGVUYWJsZVNsb3QgKnNsb3QsIFR1cGxlVGFibGVTbG90ICpzcmNzbG90LAog
CQlpZiAocmVtb3RlYXR0bnVtIDwgMCkKIAkJCWNvbnRpbnVlOwogCi0JCUFzc2VydChyZW1vdGVh
dHRudW0gPCB0dXBsZURhdGEtPm5jb2xzKTsKKwkJaWYgKHJlbW90ZWF0dG51bSA+PSB0dXBsZURh
dGEtPm5jb2xzKQorCQkJZXJlcG9ydChFUlJPUiwKKwkJCQkJKGVycmNvZGUoRVJSQ09ERV9QUk9U
T0NPTF9WSU9MQVRJT04pLAorCQkJCQkgZXJybXNnKCJsb2dpY2FsIHJlcGxpY2F0aW9uIGNvbHVt
biAlZCBub3QgZm91bmQgaW4gdHVwbGU6IG9ubHkgJWQgY29sdW1uKHMpIHJlY2VpdmVkIiwKKwkJ
CQkJCQlyZW1vdGVhdHRudW0gKyAxLCB0dXBsZURhdGEtPm5jb2xzKSkpOwogCiAJCWlmICh0dXBs
ZURhdGEtPmNvbHN0YXR1c1tyZW1vdGVhdHRudW1dICE9IExPR0lDQUxSRVBfQ09MVU1OX1VOQ0hB
TkdFRCkKIAkJewpAQCAtMjg3MCw3ICsyODgwLDEyIEBAIGFwcGx5X2hhbmRsZV91cGRhdGUoU3Ry
aW5nSW5mbyBzKQogCiAJCWlmICghYXR0LT5hdHRpc2Ryb3BwZWQgJiYgcmVtb3RlYXR0bnVtID49
IDApCiAJCXsKLQkJCUFzc2VydChyZW1vdGVhdHRudW0gPCBuZXd0dXAubmNvbHMpOworCQkJaWYg
KHJlbW90ZWF0dG51bSA+PSBuZXd0dXAubmNvbHMpCisJCQkJZXJlcG9ydChFUlJPUiwKKwkJCQkJ
CShlcnJjb2RlKEVSUkNPREVfUFJPVE9DT0xfVklPTEFUSU9OKSwKKwkJCQkJCSBlcnJtc2coImxv
Z2ljYWwgcmVwbGljYXRpb24gY29sdW1uICVkIG5vdCBmb3VuZCBpbiB0dXBsZTogb25seSAlZCBj
b2x1bW4ocykgcmVjZWl2ZWQiLAorCQkJCQkJCQlyZW1vdGVhdHRudW0gKyAxLCBuZXd0dXAubmNv
bHMpKSk7CisKIAkJCWlmIChuZXd0dXAuY29sc3RhdHVzW3JlbW90ZWF0dG51bV0gIT0gTE9HSUNB
TFJFUF9DT0xVTU5fVU5DSEFOR0VEKQogCQkJCXRhcmdldF9wZXJtaW5mby0+dXBkYXRlZENvbHMg
PQogCQkJCQlibXNfYWRkX21lbWJlcih0YXJnZXRfcGVybWluZm8tPnVwZGF0ZWRDb2xzLAotLSAK
Mi40My4wCgo=
--000000000000eb13ac0651f6df05--