pg.ddx.io  pgsql-bugs@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Tom Lane <tgl@sss.pgh.pa.us>
To: exclusion@gmail.com
Cc: pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #18273: Incorrect memory access occurs when gist__int index is building on data containing 2^31-1
Date: Sun, 07 Jan 2024 14:42:39 -0500
Message-ID: <1636926.1704656559@sss.pgh.pa.us> (raw)
In-Reply-To: <18273-9a832d1da122600c@postgresql.org>
References: <18273-9a832d1da122600c@postgresql.org>

PG Bug reporting form <noreply@postgresql.org> writes:
> As far as I can see, the loop for j shown below:
> Datum
> g_int_decompress(PG_FUNCTION_ARGS)
> {
> ...
> 	for (i = 0; i < lenin; i += 2)
> 		for (j = din[i]; j <= din[i + 1]; j++)
> 			if ((!i) || *(dr - 1) != j)
> 				*dr++ = j;
> overflows when dln[i] == dln[i+1] == 2147483647.

Yeah, you are right.  Probably the simplest fix is to widen j to
int64.  I see that somebody has already int64-ified g_int_compress
and internal_size (else we'd not get this far), but they missed this.

Will fix, thanks for report!

			regards, tom lane





view thread (2+ messages)

Message-ID: <1636926.1704656559@sss.pgh.pa.us>
Permalink:  ../1636926.1704656559@sss.pgh.pa.us/
Also on:    postgresql.org/message-id/1636926.1704656559@sss.pgh.pa.us

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-bugs@postgresql.org
  Cc: tgl@sss.pgh.pa.us, exclusion@gmail.com, pgsql-bugs@lists.postgresql.org
  Subject: Re: BUG #18273: Incorrect memory access occurs when gist__int index is building on data containing 2^31-1
  In-Reply-To: <1636926.1704656559@sss.pgh.pa.us>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox