From: Tom Lane <tgl@sss.pgh.pa.us>
To: Richard Guo <guofenglinux@gmail.com>
Cc: Alexander Lakhin <exclusion@gmail.com>
Cc: rekgrpth@gmail.com
Cc: pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #18247: Integer overflow leads to negative width
Date: Fri, 15 Dec 2023 10:30:40 -0500
Message-ID: <2992088.1702654240@sss.pgh.pa.us> (raw)
In-Reply-To: <CAMbWs4_JdZmiFCQf++kx33Lwb_9GG582Axnj1DNWwvz7FLBcKg@mail.gmail.com>
References: <18247-11ac477f02954422@postgresql.org>
<CAMbWs48nZf9XgAVpXbOnwGWWLnmoOZb51wnhkNW5xfz_PyOyCw@mail.gmail.com>
<2781181.1702565025@sss.pgh.pa.us>
<CAMbWs4_8+mtt5C8EXmfHa_Hs-OW6EhEz_XjhzBk8miwg2h65CQ@mail.gmail.com>
<f5e15fe1-202d-1936-f47c-f0c69a936b72@gmail.com>
<CAMbWs4_JdZmiFCQf++kx33Lwb_9GG582Axnj1DNWwvz7FLBcKg@mail.gmail.com>
Richard Guo <guofenglinux@gmail.com> writes:
> On Fri, Dec 15, 2023 at 2:00 PM Alexander Lakhin <exclusion@gmail.com>
>> Your patch looks good to me, but maybe you would find it suitable to fix in
>> passing one more integer overflow in costsize.c?
> Nice catch. The overflow occurs when cost_bitmap_heap_scan() calls
> compute_bitmap_pages(), and the loop_count parameter is converted from
> double to int. I wonder if we can change the loop_count parameter to be
> double for compute_bitmap_pages() to avoid such overflow.
Yeah. Seems like a flat-out error in da08a6598: that logic had been
treating loop_count as double for years, and then when it was split
out into a subroutine, somebody carelessly declared the argument as
int. (Even sillier, all the callers are trying to pass doubles.)
compute_bitmap_pages is substantially below par as to commenting,
too.
However, I'd be a bit uncomfortable about back-patching; since that
function is globally exposed, it's at least possible that some
extension is calling it and would see an ABI break. Is it good enough
to fix this in HEAD? I'd argue yes, given that a loop_count larger
than INT_MAX seems like a pretty improbable case.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: tgl@sss.pgh.pa.us, guofenglinux@gmail.com, exclusion@gmail.com, rekgrpth@gmail.com, pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #18247: Integer overflow leads to negative width
In-Reply-To: <2992088.1702654240@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox