Neon logical replication support for PG14 #309

knizhnik · 2023-09-30T13:52:54Z

No description provided.

arnica-github-connector · 2023-09-30T13:53:27Z

src/backend/access/heap/rewriteheap.c

+wallog_mapping_file(char const* path, int fd)
+{
+	char	prefix[MAXPGPATH];
+	snprintf(prefix, sizeof(prefix), "neon-file:%s", path);


Static Code Analysis Risk: CWE 121 - Stack-based Buffer Overflow - Stack based buffer overflow

The software directly writes into a stack buffer. This might lead to a stack-based buffer overflow. Avoid directly writing into stack buffers without proper boundary checks. Replace unsafe functions like strcpy, strcat, wcscpy, and wcscat with their safer counterparts such as strlcpy, strlcat, wcslcpy, and wcslcat, and use functions like strncpy, stpncpy, and their wide-character variants with caution, ensuring manual null-termination and proper buffer size checks.

Severity: High 🚨
Status: Open 🔴

References:

https://cwe.mitre.org/data/definitions/121

https://github.com/googleprojectzero/weggli

You received this notification because a new code risk has been identified

arnica-github-connector · 2023-09-30T13:53:30Z

src/backend/replication/logical/snapbuild.c

@@ -1714,6 +1716,10 @@ SnapBuildSerialize(SnapBuild *builder, XLogRecPtr lsn)
 				(errcode_for_file_access(),
 				 errmsg("could not open file \"%s\": %m", tmppath)));

+	/* NEON specific: persist snapshot in storage using logical message */
+	snprintf(prefix, sizeof(prefix), "neon-file:%s", path);


Static Code Analysis Risk: CWE 121 - Stack-based Buffer Overflow - Stack based buffer overflow

The software directly writes into a stack buffer. This might lead to a stack-based buffer overflow. Avoid directly writing into stack buffers without proper boundary checks. Replace unsafe functions like strcpy, strcat, wcscpy, and wcscat with their safer counterparts such as strlcpy, strlcat, wcslcpy, and wcslcat, and use functions like strncpy, stpncpy, and their wide-character variants with caution, ensuring manual null-termination and proper buffer size checks.

Severity: High 🚨
Status: Open 🔴

References:

https://cwe.mitre.org/data/definitions/121

https://github.com/googleprojectzero/weggli

You received this notification because a new code risk has been identified

arnica-github-connector · 2023-09-30T13:53:33Z

src/backend/replication/slot.c

+	{
+		/* NEON specific: persist slot in storage using logical message */
+		char		prefix[MAXPGPATH];
+		snprintf(prefix, sizeof(prefix), "neon-file:%s", path);


Static Code Analysis Risk: CWE 121 - Stack-based Buffer Overflow - Stack based buffer overflow

The software directly writes into a stack buffer. This might lead to a stack-based buffer overflow. Avoid directly writing into stack buffers without proper boundary checks. Replace unsafe functions like strcpy, strcat, wcscpy, and wcscat with their safer counterparts such as strlcpy, strlcat, wcslcpy, and wcslcat, and use functions like strncpy, stpncpy, and their wide-character variants with caution, ensuring manual null-termination and proper buffer size checks.

Severity: High 🚨
Status: Open 🔴

References:

https://cwe.mitre.org/data/definitions/121

https://github.com/googleprojectzero/weggli

You received this notification because a new code risk has been identified

arnica-github-connector · 2023-09-30T13:53:36Z

src/backend/replication/slot.c

+	{
+		/* NEON specific: delete slot from storage using logical message */
+		char		prefix[MAXPGPATH];
+		snprintf(prefix, sizeof(prefix), "neon-file:%s/state", path);


Static Code Analysis Risk: CWE 121 - Stack-based Buffer Overflow - Stack based buffer overflow

The software directly writes into a stack buffer. This might lead to a stack-based buffer overflow. Avoid directly writing into stack buffers without proper boundary checks. Replace unsafe functions like strcpy, strcat, wcscpy, and wcscat with their safer counterparts such as strlcpy, strlcat, wcslcpy, and wcslcat, and use functions like strncpy, stpncpy, and their wide-character variants with caution, ensuring manual null-termination and proper buffer size checks.

Severity: High 🚨
Status: Open 🔴

References:

https://cwe.mitre.org/data/definitions/121

https://github.com/googleprojectzero/weggli

You received this notification because a new code risk has been identified

arnica-github-connector · 2023-09-30T13:53:39Z

src/backend/replication/logical/snapbuild.c

@@ -2078,6 +2085,10 @@ CheckPointSnapBuild(void)
 		{
 			elog(DEBUG1, "removing snapbuild snapshot %s", path);

+			/* NEON specific: delete file from storage using logical message */
+			snprintf(prefix, sizeof(prefix), "neon-file:%s", path);


Static Code Analysis Risk: CWE 121 - Stack-based Buffer Overflow - Stack based buffer overflow

The software directly writes into a stack buffer. This might lead to a stack-based buffer overflow. Avoid directly writing into stack buffers without proper boundary checks. Replace unsafe functions like strcpy, strcat, wcscpy, and wcscat with their safer counterparts such as strlcpy, strlcat, wcslcpy, and wcslcat, and use functions like strncpy, stpncpy, and their wide-character variants with caution, ensuring manual null-termination and proper buffer size checks.

Severity: High 🚨
Status: Open 🔴

References:

https://cwe.mitre.org/data/definitions/121

https://github.com/googleprojectzero/weggli

You received this notification because a new code risk has been identified

* Neon logical replication support for PG14 * Log heap rewrite file after creation. --------- Co-authored-by: Konstantin Knizhnik <knizhnik@neon.tech> Co-authored-by: Arseny Sher <sher-ars@yandex.ru>

Neon logical replication support for PG14

182052d

arnica-github-connector bot reviewed Sep 30, 2023

View reviewed changes

Log heap rewrite file after creation.

c84ebf3

arssher approved these changes Oct 18, 2023

View reviewed changes

arssher mentioned this pull request Oct 18, 2023

Logical replication neondatabase/neon#5271

Merged

5 tasks

knizhnik merged commit ebcca9e into REL_14_STABLE_neon Oct 18, 2023

knizhnik deleted the logical_replication_v14 branch October 18, 2023 12:32

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Neon logical replication support for PG14 #309

Neon logical replication support for PG14 #309

knizhnik commented Sep 30, 2023

arnica-github-connector bot Sep 30, 2023

arnica-github-connector bot Sep 30, 2023

arnica-github-connector bot Sep 30, 2023

arnica-github-connector bot Sep 30, 2023

arnica-github-connector bot Sep 30, 2023

Neon logical replication support for PG14 #309

Neon logical replication support for PG14 #309

Conversation

knizhnik commented Sep 30, 2023

arnica-github-connector bot Sep 30, 2023

Choose a reason for hiding this comment

Static Code Analysis Risk: CWE 121 - Stack-based Buffer Overflow - Stack based buffer overflow

References:

arnica-github-connector bot Sep 30, 2023

Choose a reason for hiding this comment

Static Code Analysis Risk: CWE 121 - Stack-based Buffer Overflow - Stack based buffer overflow

References:

arnica-github-connector bot Sep 30, 2023

Choose a reason for hiding this comment

Static Code Analysis Risk: CWE 121 - Stack-based Buffer Overflow - Stack based buffer overflow

References:

arnica-github-connector bot Sep 30, 2023

Choose a reason for hiding this comment

Static Code Analysis Risk: CWE 121 - Stack-based Buffer Overflow - Stack based buffer overflow

References:

arnica-github-connector bot Sep 30, 2023

Choose a reason for hiding this comment

Static Code Analysis Risk: CWE 121 - Stack-based Buffer Overflow - Stack based buffer overflow

References: