From: Tom Lane <tgl@sss.pgh.pa.us>
To: Ewan Young <kdbase.hack@gmail.com>
cc: Heikki Linnakangas <hlinnaka@iki.fi>,
        Peter Eisentraut <peter@eisentraut.org>, 1217816127@qq.com,
        pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #19545: Integer truncation of `GinTuple.keylen` causes
 out-of-bounds read in parallel GIN index build
In-reply-to: 
 <CAON2xHN5qGXcn1Z00pQAogf4y5rCQ1K04yvrYAORBa5i+ucLBQ@mail.gmail.com>
References: <19545-0f25b7e47351e8fc@postgresql.org>
 <CAON2xHMXYLwkq4UaNbUtmaw1ZKne6OqdyyiACFQUbCj+XRBvQQ@mail.gmail.com>
 <d02fd089-b326-417a-ab2c-aea88e459c63@iki.fi>
 <CAON2xHPV-7O0MsFuizJv8cbUG7ZJfLCAqzkGYgoxF9WBe1v9Jg@mail.gmail.com>
 <d6680315-bc66-48c3-a310-bdad88a86a59@iki.fi>
 <CAON2xHN5qGXcn1Z00pQAogf4y5rCQ1K04yvrYAORBa5i+ucLBQ@mail.gmail.com>
Comments: In-reply-to Ewan Young <kdbase.hack@gmail.com>
	message dated "Thu, 09 Jul 2026 13:16:54 +0800"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <2411428.1783574907.1@sss.pgh.pa.us>
Date: Thu, 09 Jul 2026 01:28:27 -0400
Message-ID: <2411429.1783574907@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/2411429.1783574907%40sss.pgh.pa.us>
Precedence: bulk

Ewan Young <kdbase.hack@gmail.com> writes:
> Agreed, that's clearly better. v3 (attached) uses Size for
> GinTuple.keylen (GinBuffer.keylen already was Size), and also for the
> local in _gin_build_tuple(), which was the int that truncated
> VARSIZE_ANY() in the first place.

Am I reading this correctly that you propose using Size for the
length of the key value (keylen) along with int for the length of the
whole tuple (tuplen)?

 {
     int          tuplen;            /* length of the whole tuple */
     OffsetNumber attrnum;           /* attnum of index key */
-    uint16       keylen;            /* bytes in data for key value */
+    Size         keylen;            /* bytes in data for key value */
     int16        typlen;            /* typlen for key */
     bool         typbyval;          /* typbyval for key */
     signed char  category;          /* category: normal or NULL? */

Please explain how that's sane.

I kind of agree with the upthread comment that we should just reject
key lengths exceeding BLCKSZ or so up-front, rather than fooling
around with these field widths.  This patch widens GinTuple
noticeably, and will do so more if we also widen tuplen.  Is that
free?

			regards, tom lane