postgres.git / summary / log / commit / refs

commit    51f63ba2bf7f4a619f9e4251450ee462ba8505dc
Author:   Michael Paquier <michael@paquier.xyz>
Date:     Fri Jun 05 23:16:44 2026 +0000

    pg_surgery: Fix off-by-one bug with heap offset
    
    heap_force_common() declared a boolean array indexed with an
    OffsetNumber for a size of MaxHeapTuplesPerPage.  OffsetNumbers are
    1-based, so an input TID whose offset number equals MaxHeapTuplesPerPage
    wrote one byte past the end of the stack array, crashing the server.
    
    Like heapam_handler.c, this commit changes the array so as it uses a
    0-based index, substracting one from the OffsetNumbers.
    
    Reported-by: Wang Yuelin <violin0613@tju.edu.cn>
    Reviewed-by: Ashutosh Sharma <ashu.coek88@gmail.com>
    Discussion: https://postgr.es/m/20260604002256.40f1fd544@smtp.qiye.163.com
    Backpatch-through: 14


 contrib/pg_surgery/heap_surgery.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/contrib/pg_surgery/heap_surgery.c b/contrib/pg_surgery/heap_surgery.c
index 3e641aa6440..934b1d0ec21 100644
--- a/contrib/pg_surgery/heap_surgery.c
+++ b/contrib/pg_surgery/heap_surgery.c
@@ -224,8 +224,8 @@ heap_force_common(FunctionCallInfo fcinfo, HeapTupleForceOption heap_force_opt)
 			}
 
 			/* Mark it for processing. */
-			Assert(offno < MaxHeapTuplesPerPage);
-			include_this_tid[offno] = true;
+			Assert(offno <= MaxHeapTuplesPerPage);
+			include_this_tid[offno - 1] = true;
 		}
 
 		/*
@@ -243,7 +243,7 @@ heap_force_common(FunctionCallInfo fcinfo, HeapTupleForceOption heap_force_opt)
 		{
 			ItemId		itemid;
 
-			if (!include_this_tid[curoff])
+			if (!include_this_tid[curoff - 1])
 				continue;
 
 			itemid = PageGetItemId(page, curoff);


[parent: b7b513d9afab]