pg.ddx.io pgsql-bugs@postgresql.org mailing list archivehelp / color / mirror / Atom feed
BUG #18853: integer may overflow in array_user_functions 2+ messages / 2 participants [nested] [flat]
* BUG #18853: integer may overflow in array_user_functions @ 2025-03-18 08:02 PG Bug reporting form <noreply@postgresql.org> 2025-03-18 13:58 ` Re: BUG #18853: integer may overflow in array_user_functions Tom Lane <tgl@sss.pgh.pa.us> 0 siblings, 1 reply; 2+ messages in thread From: PG Bug reporting form @ 2025-03-18 08:02 UTC (permalink / raw) To: pgsql-bugs@lists.postgresql.org; +Cc: ma100@hotmail.com The following bug has been logged on the website: Bug reference: 18853 Logged by: ma liangzhu Email address: ma100@hotmail.com PostgreSQL version: 17.0 Operating system: centos Description: I noticed that in the array_userfunc.c file, there are many calculations involving int32 without overflow checks. For example: int reqsize = state1->nbytes + state2->nbytes; This could potentially cause overflow, leading to issues. ^ permalink raw reply [nested|flat] 2+ messages in thread
* Re: BUG #18853: integer may overflow in array_user_functions 2025-03-18 08:02 BUG #18853: integer may overflow in array_user_functions PG Bug reporting form <noreply@postgresql.org> @ 2025-03-18 13:58 ` Tom Lane <tgl@sss.pgh.pa.us> 0 siblings, 0 replies; 2+ messages in thread From: Tom Lane @ 2025-03-18 13:58 UTC (permalink / raw) To: ma100@hotmail.com; +Cc: pgsql-bugs@lists.postgresql.org PG Bug reporting form <noreply@postgresql.org> writes: > I noticed that in the array_userfunc.c file, there are many calculations > involving int32 without overflow checks. > For example: > int reqsize = state1->nbytes + state2->nbytes; This particular example is expected not to overflow because Datum sizes are restricted to be < 1GB. There may indeed be live overflow hazards in array_userfunc.c (or elsewhere), but you will need a considerably more sophisticated analysis to demonstrate it. regards, tom lane ^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2025-03-18 13:58 UTC | newest] Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2025-03-18 08:02 BUG #18853: integer may overflow in array_user_functions PG Bug reporting form <noreply@postgresql.org> 2025-03-18 13:58 ` Tom Lane <tgl@sss.pgh.pa.us>
This inbox is served by DDX for PostgreSQL; see mirroring instructions for how to clone and mirror all data and code used for this inbox