Avoid referencing off the end of subplan_partition_offsets.

Report by buildfarm member skink and Tom Lane.  Analysis by me.
Patch by Amit Khandekar.

Discussion: http://postgr.es/m/CAJ3gD9fVA1iXQYhfqHP5n_TEd4U9=V8TL_cc-oKRnRmxgdvJrQ@mail.gmail.com

diff --git a/src/backend/executor/execPartition.c b/src/backend/executor/execPartition.c
index 89b7bb4c6082653357de5d0baea2097497179234..106a96d9103ab1f0ae2dbcf495a2f915bdbed359 100644 (file)
--- a/src/backend/executor/execPartition.c
+++ b/src/backend/executor/execPartition.c
@@ -87,6 +87,7 @@ ExecSetupPartitionTupleRouting(ModifyTableState *mtstate,
                num_update_rri = list_length(node->plans);
                proute->subplan_partition_offsets =
                        palloc(num_update_rri * sizeof(int));
+               proute->num_subplan_partition_offsets = num_update_rri;
 
                /*
                 * We need an additional tuple slot for storing transient tuples that
@@ -481,6 +482,7 @@ ExecCleanupTupleRouting(PartitionTupleRouting *proute)
                 * result rels are present in the UPDATE subplans.
                 */
                if (proute->subplan_partition_offsets &&
+                       subplan_index < proute->num_subplan_partition_offsets &&
                        proute->subplan_partition_offsets[subplan_index] == i)
                {
                        subplan_index++;

diff --git a/src/backend/executor/nodeModifyTable.c b/src/backend/executor/nodeModifyTable.c
index 6c2f8d4ec03f9fc59b6e65b7a484fe9fb382607f..828e1b0015bc1a27637f574c32798af1dd18cf71 100644 (file)
--- a/src/backend/executor/nodeModifyTable.c
+++ b/src/backend/executor/nodeModifyTable.c
@@ -1812,7 +1812,8 @@ tupconv_map_for_subplan(ModifyTableState *mtstate, int whichplan)
                 * If subplan-indexed array is NULL, things should have been arranged
                 * to convert the subplan index to partition index.
                 */
-               Assert(proute && proute->subplan_partition_offsets != NULL);
+               Assert(proute && proute->subplan_partition_offsets != NULL &&
+                          whichplan < proute->num_subplan_partition_offsets);
 
                leaf_index = proute->subplan_partition_offsets[whichplan];
 

diff --git a/src/include/executor/execPartition.h b/src/include/executor/execPartition.h
index 18e08129f84d6e477d5ec77c927f413429276b19..3df9c498bbf6d93e4183ec484783ccae542bba38 100644 (file)
--- a/src/include/executor/execPartition.h
+++ b/src/include/executor/execPartition.h
@@ -80,6 +80,7 @@ typedef struct PartitionDispatchData *PartitionDispatch;
  * subplan_partition_offsets   Integer array ordered by UPDATE subplans. Each
  *                                                             element of this array has the index into the
  *                                                             corresponding partition in partitions array.
+ * num_subplan_partition_offsets  Length of 'subplan_partition_offsets' array
  * partition_tuple_slot                        TupleTableSlot to be used to manipulate any
  *                                                             given leaf partition's rowtype after that
  *                                                             partition is chosen for insertion by
@@ -96,6 +97,7 @@ typedef struct PartitionTupleRouting
        TupleConversionMap **child_parent_tupconv_maps;
        bool       *child_parent_map_not_required;
        int                *subplan_partition_offsets;
+       int                     num_subplan_partition_offsets;
        TupleTableSlot *partition_tuple_slot;
        TupleTableSlot *root_tuple_slot;
 } PartitionTupleRouting;