From e79c0648cfe5a94cc7c1c8f713d0c8097da8f7c8 Mon Sep 17 00:00:00 2001
From: Sven Klemm <sven@timescale.com>
Date: Fri, 9 Oct 2020 01:08:42 +0200
Subject: [PATCH] Fix member access within misaligned address in
 chunk_update_colstats

The array argument passed to array_length is treated as AnyArrayType
which is a union of ArrayType and ExpandedArrayHeader, which lead to
member access within misaligned address when used on the argument
passed to array_length by chunk_update_colstats which is ArrayType.
---
 tsl/src/chunk_api.c | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/tsl/src/chunk_api.c b/tsl/src/chunk_api.c
index 70dad9735..1301abb50 100644
--- a/tsl/src/chunk_api.c
+++ b/tsl/src/chunk_api.c
@@ -4,25 +4,26 @@
  * LICENSE-TIMESCALE for a copy of the license.
  */
 #include <postgres.h>
-#include <utils/jsonb.h>
-#include <utils/lsyscache.h>
-#include <utils/syscache.h>
-#include <utils/builtins.h>
-#include <catalog/indexing.h>
-#include <catalog/pg_type.h>
-#include <catalog/pg_class.h>
-#include <catalog/pg_inherits.h>
-#include <catalog/pg_operator.h>
-#include <catalog/pg_namespace.h>
-#include <access/htup.h>
 #include <access/htup_details.h>
+#include <access/htup.h>
+#include <access/multixact.h>
 #include <access/visibilitymap.h>
 #include <access/xact.h>
-#include <access/multixact.h>
+#include <catalog/indexing.h>
+#include <catalog/pg_class.h>
+#include <catalog/pg_inherits.h>
+#include <catalog/pg_namespace.h>
+#include <catalog/pg_operator.h>
+#include <catalog/pg_type.h>
 #include <commands/vacuum.h>
 #include <fmgr.h>
 #include <funcapi.h>
 #include <miscadmin.h>
+#include <utils/array.h>
+#include <utils/builtins.h>
+#include <utils/jsonb.h>
+#include <utils/lsyscache.h>
+#include <utils/syscache.h>
 
 #include <catalog.h>
 #include <compat.h>
@@ -949,8 +950,7 @@ chunk_update_colstats(Chunk *chunk, int16 attnum, float nullfract, int32 width,
 		Assert(HeapTupleIsValid(type_tuple));
 		type = (Form_pg_type) GETSTRUCT(type_tuple);
 		Assert(slot_values[k] != NULL);
-		nelems = DatumGetInt32(
-			DirectFunctionCall2(array_length, PointerGetDatum(slot_values[k]), Int32GetDatum(1)));
+		nelems = ARR_DIMS(slot_values[k])[0];
 
 		decoded_data = palloc0(nelems * sizeof(Datum));