There is a bug in aclinsert3 in the code which update the acl arrays.

When an acl item is added or updated the new entry is deleted if it has no
permissions and the acl array is shrinked. This is is done by decrementing
the number of items without updating the corresponding array size.
The array with the incorrect size is later read by pg_aclcheck and the entry
count is used to allocate a new array while the array size is used to copy
the old one. This causes a memory corruption and a backend crash.
This happens only to normal user as the administrator bypasses acl checks.
Massimo Dal Zotto

diff --git a/src/backend/utils/adt/acl.c b/src/backend/utils/adt/acl.c
index 76c0f91be84e9e782c0866ec23d42738431445ea..60752ea8c9e5de0f38b6243da531559dd9f9e695 100644 (file)
--- a/src/backend/utils/adt/acl.c
+++ b/src/backend/utils/adt/acl.c
@@ -7,7 +7,7 @@
  *
  *
  * IDENTIFICATION
- *    $Header: /cvsroot/pgsql/src/backend/utils/adt/acl.c,v 1.7 1996/11/17 04:26:59 momjian Exp $
+ *    $Header: /cvsroot/pgsql/src/backend/utils/adt/acl.c,v 1.8 1996/11/20 22:53:10 momjian Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -417,6 +417,8 @@ aclinsert3(Acl *old_acl, AclItem *mod_aip, unsigned modechg)
                new_aip[i-1].ai_mode = new_aip[i].ai_mode;
            }
            ARR_DIMS(new_acl)[0] = num -1 ;
+           /* Adjust also the array size because it is used for memmove */
+           ARR_SIZE(new_acl) -= sizeof(AclItem);
            break;
        }
     }