citus
citus copied to clipboard
Undefined behavior for bit shift in citus_stat_tenants.c
We have bit shift operation without control of shift length in citus_stat_tenants.c. Shift operators where the amount shifted is greater or equal to the promoted bit-width of the left hand side or less than zero, or where the left hand side is negative, can lead to undefined bahavior.
https://github.com/citusdata/citus/blob/0e6127c4f60b26da18ac8df48d2b6a8de5ed9d4c/src/backend/distributed/utils/citus_stat_tenants.c#L608
/*
* If the last score reduction was not in this period we do score reduction now.
*/
if (periodCountAfterLastScoreReduction > 0)
{
tenantStats->score >>= periodCountAfterLastScoreReduction;
tenantStats->lastScoreReduction = queryTime;
}
I caught this problem with sanitizer. It seems on start
stats->lastScoreReduction = 0;
and it lead to bitwise shifts that are out of bounds for their data type
Also, it seems, better to backport it at least at release-13.0 and release-12.1