pg.ddx.io  pgsql-bugs@postgresql.org mailing list archive  
help / color / mirror / Atom feed
From: PG Bug reporting form <noreply@postgresql.org>
To: pgsql-bugs@lists.postgresql.org
Cc: ma100@hotmail.com
Subject: BUG #18853: integer may overflow in array_user_functions
Date: Tue, 18 Mar 2025 08:02:46 +0000
Message-ID: <18853-46697b88110224a7@postgresql.org> (raw)

The following bug has been logged on the website:

Bug reference:      18853
Logged by:          ma liangzhu
Email address:      ma100@hotmail.com
PostgreSQL version: 17.0
Operating system:   centos
Description:        

I noticed that in the array_userfunc.c file, there are many calculations
involving int32 without overflow checks. 

For example: 

int reqsize = state1->nbytes + state2->nbytes; 

This could potentially cause overflow, leading to issues.



view thread (2+ messages)  latest in thread

Message-ID: <18853-46697b88110224a7@postgresql.org>
Permalink:  ../18853-46697b88110224a7@postgresql.org/
Also on:    postgresql.org/message-id/18853-46697b88110224a7@postgresql.org

 · 

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-bugs@postgresql.org
  Cc: noreply@postgresql.org, pgsql-bugs@lists.postgresql.org, ma100@hotmail.com
  Subject: Re: BUG #18853: integer may overflow in array_user_functions
  In-Reply-To: <18853-46697b88110224a7@postgresql.org>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox