Received: from malur.postgresql.org ([217.196.149.56])
	by arkaria.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.94.2)
	(envelope-from <pgsql-bugs-owner+archive@lists.postgresql.org>)
	id 1tuXSU-009cnj-IY
	for pgsql-bugs@arkaria.postgresql.org; Tue, 18 Mar 2025 13:58:18 +0000
Received: from localhost ([127.0.0.1] helo=malur.postgresql.org)
	by malur.postgresql.org with esmtp (Exim 4.94.2)
	(envelope-from <pgsql-bugs-owner+archive@lists.postgresql.org>)
	id 1tuXSS-00FJGh-87
	for pgsql-bugs@arkaria.postgresql.org; Tue, 18 Mar 2025 13:58:16 +0000
Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29])
	by malur.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.94.2)
	(envelope-from <tgl@sss.pgh.pa.us>)
	id 1tuXSR-00FJGZ-Vl
	for pgsql-bugs@lists.postgresql.org; Tue, 18 Mar 2025 13:58:15 +0000
Received: from sss.pgh.pa.us ([68.162.161.243])
	by magus.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.96)
	(envelope-from <tgl@sss.pgh.pa.us>)
	id 1tuXSO-003ZjX-0I
	for pgsql-bugs@lists.postgresql.org;
	Tue, 18 Mar 2025 13:58:15 +0000
Received: from sss1.sss.pgh.pa.us (localhost [127.0.0.1])
	by sss.pgh.pa.us (8.15.2/8.15.2) with ESMTP id 52IDw556017182;
	Tue, 18 Mar 2025 09:58:05 -0400
From: Tom Lane <tgl@sss.pgh.pa.us>
To: ma100@hotmail.com
cc: pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #18853: integer may overflow in array_user_functions
In-reply-to: <18853-46697b88110224a7@postgresql.org>
References: <18853-46697b88110224a7@postgresql.org>
Comments: In-reply-to PG Bug reporting form <noreply@postgresql.org>
	message dated "Tue, 18 Mar 2025 08:02:46 -0000"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <17180.1742306285.1@sss.pgh.pa.us>
Date: Tue, 18 Mar 2025 09:58:05 -0400
Message-ID: <17181.1742306285@sss.pgh.pa.us>
List-Id: <pgsql-bugs.lists.postgresql.org>
List-Help: <https://lists.postgresql.org/manage/>
List-Subscribe: <https://lists.postgresql.org/manage/>
List-Post: <mailto:pgsql-bugs@lists.postgresql.org>
List-Owner: <mailto:pgsql-bugs-owner@lists.postgresql.org>
List-Archive: <https://www.postgresql.org/list/pgsql-bugs>
Archived-At: 
 <https://www.postgresql.org/message-id/17181.1742306285%40sss.pgh.pa.us>
Precedence: bulk

PG Bug reporting form <noreply@postgresql.org> writes:
> I noticed that in the array_userfunc.c file, there are many calculations
> involving int32 without overflow checks. 

> For example: 
> int reqsize = state1->nbytes + state2->nbytes; 

This particular example is expected not to overflow because Datum
sizes are restricted to be < 1GB.  There may indeed be live overflow
hazards in array_userfunc.c (or elsewhere), but you will need a
considerably more sophisticated analysis to demonstrate it.

			regards, tom lane