From: Tom Lane <tgl@sss.pgh.pa.us>
To: exclusion@gmail.com
cc: pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #18273: Incorrect memory access occurs when gist__int index
 is building on data containing 2^31-1
In-reply-to: <18273-9a832d1da122600c@postgresql.org>
References: <18273-9a832d1da122600c@postgresql.org>
Comments: In-reply-to PG Bug reporting form <noreply@postgresql.org>
	message dated "Sat, 06 Jan 2024 19:00:00 +0000"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <1636925.1704656559.1@sss.pgh.pa.us>
Date: Sun, 07 Jan 2024 14:42:39 -0500
Message-ID: <1636926.1704656559@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/1636926.1704656559%40sss.pgh.pa.us>
Precedence: bulk

PG Bug reporting form <noreply@postgresql.org> writes:
> As far as I can see, the loop for j shown below:
> Datum
> g_int_decompress(PG_FUNCTION_ARGS)
> {
> ...
> 	for (i = 0; i < lenin; i += 2)
> 		for (j = din[i]; j <= din[i + 1]; j++)
> 			if ((!i) || *(dr - 1) != j)
> 				*dr++ = j;
> overflows when dln[i] == dln[i+1] == 2147483647.

Yeah, you are right.  Probably the simplest fix is to widen j to
int64.  I see that somebody has already int64-ified g_int_compress
and internal_size (else we'd not get this far), but they missed this.

Will fix, thanks for report!

			regards, tom lane