bdr: Don't read past the end of shmem in bdr_sequencer_wakeup
authorCraig Ringer <craig@2ndquadrant.com>
Wed, 19 Nov 2014 05:58:15 +0000 (13:58 +0800)
committerCraig Ringer <craig@2ndquadrant.com>
Wed, 19 Nov 2014 06:00:22 +0000 (14:00 +0800)
bdr_sequencer_wakeup() was iterating over BdrSequencerCtl->slots
using bdr_seq_nnodes instead of bdr_seq_nsequencers, which would
cause it to attempt access past the end of the shared memory segment
allocated for BdrSequencerCtl.

bdr_seq.c

index 6d772413994f211972010cea8d6a29e51408511f..6dc54158c772af09113a4b4effb8fcc3973592e8 100644 (file)
--- a/bdr_seq.c
+++ b/bdr_seq.c
@@ -519,6 +519,8 @@ bdr_sequencer_shmem_shutdown(int code, Datum arg)
    if (seq_slot < 0)
        return;
 
+   Assert(seq_slot < bdr_seq_nsequencers);
+
    slot = &BdrSequencerCtl->slots[seq_slot];
 
    slot->database_oid = InvalidOid;
@@ -552,6 +554,7 @@ void
 bdr_sequencer_shmem_init(int nnodes, int sequencers)
 {
    Assert(process_shared_preload_libraries_in_progress);
+   Assert(nnodes >= sequencers);
 
    bdr_seq_nnodes = nnodes;
    bdr_seq_nsequencers = sequencers;
@@ -569,7 +572,7 @@ bdr_sequencer_wakeup(void)
    BdrSequencerSlot *slot;
 
 
-   for (off = 0; off < bdr_seq_nnodes; off++)
+   for (off = 0; off < bdr_seq_nsequencers; off++)
    {
        slot = &BdrSequencerCtl->slots[off];