Avoid referencing off the end of subplan_partition_offsets.

Report by buildfarm member skink and Tom Lane.  Analysis by me.
Patch by Amit Khandekar.

Discussion: http://postgr.es/m/CAJ3gD9fVA1iXQYhfqHP5n_TEd4U9=V8TL_cc-oKRnRmxgdvJrQ@mail.gmail.com

diff --git a/src/backend/executor/execPartition.c b/src/backend/executor/execPartition.c
index 89b7bb4c6082653357de5d0baea2097497179234..106a96d9103ab1f0ae2dbcf495a2f915bdbed359 100644 (file)
--- a/src/backend/executor/execPartition.c
+++ b/src/backend/executor/execPartition.c
@@ -87,6 +87,7 @@ ExecSetupPartitionTupleRouting(ModifyTableState *mtstate,
        num_update_rri = list_length(node->plans);
        proute->subplan_partition_offsets =
            palloc(num_update_rri * sizeof(int));
+       proute->num_subplan_partition_offsets = num_update_rri;
 
        /*
         * We need an additional tuple slot for storing transient tuples that
@@ -481,6 +482,7 @@ ExecCleanupTupleRouting(PartitionTupleRouting *proute)
         * result rels are present in the UPDATE subplans.
         */
        if (proute->subplan_partition_offsets &&
+           subplan_index < proute->num_subplan_partition_offsets &&
            proute->subplan_partition_offsets[subplan_index] == i)
        {
            subplan_index++;

diff --git a/src/backend/executor/nodeModifyTable.c b/src/backend/executor/nodeModifyTable.c
index 6c2f8d4ec03f9fc59b6e65b7a484fe9fb382607f..828e1b0015bc1a27637f574c32798af1dd18cf71 100644 (file)
--- a/src/backend/executor/nodeModifyTable.c
+++ b/src/backend/executor/nodeModifyTable.c
@@ -1812,7 +1812,8 @@ tupconv_map_for_subplan(ModifyTableState *mtstate, int whichplan)
         * If subplan-indexed array is NULL, things should have been arranged
         * to convert the subplan index to partition index.
         */
-       Assert(proute && proute->subplan_partition_offsets != NULL);
+       Assert(proute && proute->subplan_partition_offsets != NULL &&
+              whichplan < proute->num_subplan_partition_offsets);
 
        leaf_index = proute->subplan_partition_offsets[whichplan];
 

diff --git a/src/include/executor/execPartition.h b/src/include/executor/execPartition.h
index 18e08129f84d6e477d5ec77c927f413429276b19..3df9c498bbf6d93e4183ec484783ccae542bba38 100644 (file)
--- a/src/include/executor/execPartition.h
+++ b/src/include/executor/execPartition.h
@@ -80,6 +80,7 @@ typedef struct PartitionDispatchData *PartitionDispatch;
  * subplan_partition_offsets   Integer array ordered by UPDATE subplans. Each
  *                             element of this array has the index into the
  *                             corresponding partition in partitions array.
+ * num_subplan_partition_offsets  Length of 'subplan_partition_offsets' array
  * partition_tuple_slot            TupleTableSlot to be used to manipulate any
  *                             given leaf partition's rowtype after that
  *                             partition is chosen for insertion by
@@ -96,6 +97,7 @@ typedef struct PartitionTupleRouting
    TupleConversionMap **child_parent_tupconv_maps;
    bool       *child_parent_map_not_required;
    int        *subplan_partition_offsets;
+   int         num_subplan_partition_offsets;
    TupleTableSlot *partition_tuple_slot;
    TupleTableSlot *root_tuple_slot;
 } PartitionTupleRouting;