MIME-Version: 1.0
References: <19405-1ecf025dda171555@postgresql.org> <CAMbWs4_GnG0NYnsBZJpHG-BLo28euD6VUx0WhFd4Ur6RaLr5WQ@mail.gmail.com>
 <b718571e-acc6-4e64-a238-15076a6ad0f0@gmail.com> <CAMbWs4_jYG-vjN579aLuE7pf9PaZaPL9KCjPRN0kn3T+obE7hw@mail.gmail.com>
In-Reply-To: <CAMbWs4_jYG-vjN579aLuE7pf9PaZaPL9KCjPRN0kn3T+obE7hw@mail.gmail.com>
From: Richard Guo <guofenglinux@gmail.com>
Date: Sat, 14 Feb 2026 22:44:48 +0900
Message-ID: <CAMbWs4-i9Hk8+fyxoT88ixbrBYuT+2=d9nLqFLi8jfS3k_z68w@mail.gmail.com>
Subject: Re: BUG #19405: Assertion in eval_windowaggregates() fails due to
 integer overflow
To: Alexander Lakhin <exclusion@gmail.com>
Cc: pgsql-bugs@lists.postgresql.org
Content-Type: multipart/mixed; boundary="00000000000097289a064ac8ed17"
Archived-At: <https://www.postgresql.org/message-id/CAMbWs4-i9Hk8%2BfyxoT88ixbrBYuT%2B2%3Dd9nLqFLi8jfS3k_z68w%40mail.gmail.com>
Precedence: bulk

--00000000000097289a064ac8ed17
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Sat, Feb 14, 2026 at 8:00=E2=80=AFPM Richard Guo <guofenglinux@gmail.com=
> wrote:
> Right, I noticed this one too.  Basically, nodeWindowAgg.c doesn't
> check for overflow when adding startOffsetValue or endOffsetValue.
> Since these values are provided by the user and can be arbitrarily
> large, simple addition does not seem safe.  I think we may need to
> switch to overflow-aware integer operations in all relevant code.

Here is an updated patch to fix all relevant code in nodeWindowAgg.c.

- Richard

--00000000000097289a064ac8ed17
Content-Type: application/octet-stream; 
	name="v2-0001-Fix-signed-integer-overflow-in-nodeWindowAgg.c.patch"
Content-Disposition: attachment; 
	filename="v2-0001-Fix-signed-integer-overflow-in-nodeWindowAgg.c.patch"
Content-Transfer-Encoding: base64
Content-ID: <f_mlmdbugr0>
X-Attachment-Id: f_mlmdbugr0

RnJvbSA5NTg5NTEwZjRlMjg0ZWY0ZWU5ZjBhOTVmYWM1NzJhY2VkNDNjYmU3IE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiBSaWNoYXJkIEd1byA8Z3VvZmVuZ2xpbnV4QGdtYWlsLmNvbT4K
RGF0ZTogU2F0LCAxNCBGZWIgMjAyNiAxODoxNjoyNyArMDkwMApTdWJqZWN0OiBbUEFUQ0ggdjJd
IEZpeCBzaWduZWQgaW50ZWdlciBvdmVyZmxvdyBpbiBub2RlV2luZG93QWdnLmMKCi0tLQogc3Jj
L2JhY2tlbmQvZXhlY3V0b3Ivbm9kZVdpbmRvd0FnZy5jIHwgNTQgKysrKysrKysrKysrKysrKysr
KysrKysrKy0tLQogMSBmaWxlIGNoYW5nZWQsIDQ5IGluc2VydGlvbnMoKyksIDUgZGVsZXRpb25z
KC0pCgpkaWZmIC0tZ2l0IGEvc3JjL2JhY2tlbmQvZXhlY3V0b3Ivbm9kZVdpbmRvd0FnZy5jIGIv
c3JjL2JhY2tlbmQvZXhlY3V0b3Ivbm9kZVdpbmRvd0FnZy5jCmluZGV4IGQ5YjY0YjBmNDY1Li5k
YWIwNTdkZjBiZCAxMDA2NDQKLS0tIGEvc3JjL2JhY2tlbmQvZXhlY3V0b3Ivbm9kZVdpbmRvd0Fn
Zy5jCisrKyBiL3NyYy9iYWNrZW5kL2V4ZWN1dG9yL25vZGVXaW5kb3dBZ2cuYwpAQCAtMzcsNiAr
MzcsNyBAQAogI2luY2x1ZGUgImNhdGFsb2cvb2JqZWN0YWNjZXNzLmgiCiAjaW5jbHVkZSAiY2F0
YWxvZy9wZ19hZ2dyZWdhdGUuaCIKICNpbmNsdWRlICJjYXRhbG9nL3BnX3Byb2MuaCIKKyNpbmNs
dWRlICJjb21tb24vaW50LmgiCiAjaW5jbHVkZSAiZXhlY3V0b3IvZXhlY3V0b3IuaCIKICNpbmNs
dWRlICJleGVjdXRvci9ub2RlV2luZG93QWdnLmgiCiAjaW5jbHVkZSAibWlzY2FkbWluLmgiCkBA
IC0xNTMyLDEyICsxNTMzLDE3IEBAIHJvd19pc19pbl9mcmFtZShXaW5kb3dPYmplY3Qgd2lub2Jq
LCBpbnQ2NCBwb3MsIFR1cGxlVGFibGVTbG90ICpzbG90LAogCQlpZiAoZnJhbWVPcHRpb25zICYg
RlJBTUVPUFRJT05fUk9XUykKIAkJewogCQkJaW50NjQJCW9mZnNldCA9IERhdHVtR2V0SW50NjQo
d2luc3RhdGUtPmVuZE9mZnNldFZhbHVlKTsKKwkJCWludDY0CQl0YXJnZXRfcG9zOwogCiAJCQkv
KiByb3dzIGFmdGVyIGN1cnJlbnQgcm93ICsgb2Zmc2V0IGFyZSBvdXQgb2YgZnJhbWUgKi8KIAkJ
CWlmIChmcmFtZU9wdGlvbnMgJiBGUkFNRU9QVElPTl9FTkRfT0ZGU0VUX1BSRUNFRElORykKIAkJ
CQlvZmZzZXQgPSAtb2Zmc2V0OwogCi0JCQlpZiAocG9zID4gd2luc3RhdGUtPmN1cnJlbnRwb3Mg
KyBvZmZzZXQpCisJCQlpZiAocGdfYWRkX3M2NF9vdmVyZmxvdyh3aW5zdGF0ZS0+Y3VycmVudHBv
cywgb2Zmc2V0LCAmdGFyZ2V0X3BvcykpCisJCQl7CisJCQkJLyogb3ZlcmZsb3c6IGZyYW1lIGV4
dGVuZHMgdG8gZW5kIG9mIHBhcnRpdGlvbiAqLworCQkJfQorCQkJZWxzZSBpZiAocG9zID4gdGFy
Z2V0X3BvcykKIAkJCQlyZXR1cm4gLTE7CiAJCX0KIAkJZWxzZSBpZiAoZnJhbWVPcHRpb25zICYg
KEZSQU1FT1BUSU9OX1JBTkdFIHwgRlJBTUVPUFRJT05fR1JPVVBTKSkKQEAgLTE2NzIsNyArMTY3
OCwxNiBAQCB1cGRhdGVfZnJhbWVoZWFkcG9zKFdpbmRvd0FnZ1N0YXRlICp3aW5zdGF0ZSkKIAkJ
CWlmIChmcmFtZU9wdGlvbnMgJiBGUkFNRU9QVElPTl9TVEFSVF9PRkZTRVRfUFJFQ0VESU5HKQog
CQkJCW9mZnNldCA9IC1vZmZzZXQ7CiAKLQkJCXdpbnN0YXRlLT5mcmFtZWhlYWRwb3MgPSB3aW5z
dGF0ZS0+Y3VycmVudHBvcyArIG9mZnNldDsKKwkJCS8qCisJCQkgKiBJZiB3ZSBoYXZlIGFuIG92
ZXJmbG93LCBpdCBtZWFucyB0aGUgZnJhbWUgaGVhZCBpcyBiZXlvbmQgdGhlCisJCQkgKiByYW5n
ZSBvZiBpbnQ2NC4gIFNpbmNlIGN1cnJlbnRwb3MgPj0gMCwgdGhpcyBjYW4gb25seSBiZSBhCisJ
CQkgKiBwb3NpdGl2ZSBvdmVyZmxvdy4gIFdlIHRyZWF0IHRoaXMgYXMgYmVpbmcgYmV5b25kIGVu
ZCBvZgorCQkJICogcGFydGl0aW9uLgorCQkJICovCisJCQlpZiAocGdfYWRkX3M2NF9vdmVyZmxv
dyh3aW5zdGF0ZS0+Y3VycmVudHBvcywgb2Zmc2V0LAorCQkJCQkJCQkJJndpbnN0YXRlLT5mcmFt
ZWhlYWRwb3MpKQorCQkJCXdpbnN0YXRlLT5mcmFtZWhlYWRwb3MgPSBQR19JTlQ2NF9NQVg7CisK
IAkJCS8qIGZyYW1lIGhlYWQgY2FuJ3QgZ28gYmVmb3JlIGZpcnN0IHJvdyAqLwogCQkJaWYgKHdp
bnN0YXRlLT5mcmFtZWhlYWRwb3MgPCAwKQogCQkJCXdpbnN0YXRlLT5mcmFtZWhlYWRwb3MgPSAw
OwpAQCAtMTc4OSw3ICsxODA0LDE2IEBAIHVwZGF0ZV9mcmFtZWhlYWRwb3MoV2luZG93QWdnU3Rh
dGUgKndpbnN0YXRlKQogCQkJaWYgKGZyYW1lT3B0aW9ucyAmIEZSQU1FT1BUSU9OX1NUQVJUX09G
RlNFVF9QUkVDRURJTkcpCiAJCQkJbWluaGVhZGdyb3VwID0gd2luc3RhdGUtPmN1cnJlbnRncm91
cCAtIG9mZnNldDsKIAkJCWVsc2UKLQkJCQltaW5oZWFkZ3JvdXAgPSB3aW5zdGF0ZS0+Y3VycmVu
dGdyb3VwICsgb2Zmc2V0OworCQkJeworCQkJCS8qCisJCQkJICogSWYgd2UgaGF2ZSBhbiBvdmVy
ZmxvdywgaXQgbWVhbnMgdGhlIHRhcmdldCBncm91cCBpcyBiZXlvbmQKKwkJCQkgKiB0aGUgcmFu
Z2Ugb2YgaW50NjQuICBXZSB0cmVhdCB0aGlzIGFzICJpbmZpbml0eSIsIHdoaWNoCisJCQkJICog
ZW5zdXJlcyB0aGUgbG9vcCBiZWxvdyBhZHZhbmNlcyB0byBlbmQgb2YgcGFydGl0aW9uLgorCQkJ
CSAqLworCQkJCWlmIChwZ19hZGRfczY0X292ZXJmbG93KHdpbnN0YXRlLT5jdXJyZW50Z3JvdXAs
IG9mZnNldCwKKwkJCQkJCQkJCQkmbWluaGVhZGdyb3VwKSkKKwkJCQkJbWluaGVhZGdyb3VwID0g
UEdfSU5UNjRfTUFYOworCQkJfQogCiAJCQl0dXBsZXN0b3JlX3NlbGVjdF9yZWFkX3BvaW50ZXIo
d2luc3RhdGUtPmJ1ZmZlciwKIAkJCQkJCQkJCQkgICB3aW5zdGF0ZS0+ZnJhbWVoZWFkX3B0cik7
CkBAIC0xOTI2LDcgKzE5NTAsMTggQEAgdXBkYXRlX2ZyYW1ldGFpbHBvcyhXaW5kb3dBZ2dTdGF0
ZSAqd2luc3RhdGUpCiAJCQlpZiAoZnJhbWVPcHRpb25zICYgRlJBTUVPUFRJT05fRU5EX09GRlNF
VF9QUkVDRURJTkcpCiAJCQkJb2Zmc2V0ID0gLW9mZnNldDsKIAotCQkJd2luc3RhdGUtPmZyYW1l
dGFpbHBvcyA9IHdpbnN0YXRlLT5jdXJyZW50cG9zICsgb2Zmc2V0ICsgMTsKKwkJCS8qCisJCQkg
KiBJZiB3ZSBoYXZlIGFuIG92ZXJmbG93LCBpdCBtZWFucyB0aGUgZnJhbWUgdGFpbCBpcyBiZXlv
bmQgdGhlCisJCQkgKiByYW5nZSBvZiBpbnQ2NC4gIFNpbmNlIGN1cnJlbnRwb3MgPj0gMCwgdGhp
cyBjYW4gb25seSBiZSBhCisJCQkgKiBwb3NpdGl2ZSBvdmVyZmxvdy4gIFdlIHRyZWF0IHRoaXMg
YXMgYmVpbmcgYmV5b25kIGVuZCBvZgorCQkJICogcGFydGl0aW9uLgorCQkJICovCisJCQlpZiAo
cGdfYWRkX3M2NF9vdmVyZmxvdyh3aW5zdGF0ZS0+Y3VycmVudHBvcywgb2Zmc2V0LAorCQkJCQkJ
CQkJJndpbnN0YXRlLT5mcmFtZXRhaWxwb3MpIHx8CisJCQkJcGdfYWRkX3M2NF9vdmVyZmxvdyh3
aW5zdGF0ZS0+ZnJhbWV0YWlscG9zLCAxLAorCQkJCQkJCQkJJndpbnN0YXRlLT5mcmFtZXRhaWxw
b3MpKQorCQkJCXdpbnN0YXRlLT5mcmFtZXRhaWxwb3MgPSBQR19JTlQ2NF9NQVg7CisKIAkJCS8q
IHNtYWxsZXN0IGFsbG93YWJsZSB2YWx1ZSBvZiBmcmFtZXRhaWxwb3MgaXMgMCAqLwogCQkJaWYg
KHdpbnN0YXRlLT5mcmFtZXRhaWxwb3MgPCAwKQogCQkJCXdpbnN0YXRlLT5mcmFtZXRhaWxwb3Mg
PSAwOwpAQCAtMjA0Myw3ICsyMDc4LDE2IEBAIHVwZGF0ZV9mcmFtZXRhaWxwb3MoV2luZG93QWdn
U3RhdGUgKndpbnN0YXRlKQogCQkJaWYgKGZyYW1lT3B0aW9ucyAmIEZSQU1FT1BUSU9OX0VORF9P
RkZTRVRfUFJFQ0VESU5HKQogCQkJCW1heHRhaWxncm91cCA9IHdpbnN0YXRlLT5jdXJyZW50Z3Jv
dXAgLSBvZmZzZXQ7CiAJCQllbHNlCi0JCQkJbWF4dGFpbGdyb3VwID0gd2luc3RhdGUtPmN1cnJl
bnRncm91cCArIG9mZnNldDsKKwkJCXsKKwkJCQkvKgorCQkJCSAqIElmIHdlIGhhdmUgYW4gb3Zl
cmZsb3csIGl0IG1lYW5zIHRoZSB0YXJnZXQgZ3JvdXAgaXMgYmV5b25kCisJCQkJICogdGhlIHJh
bmdlIG9mIGludDY0LiAgV2UgdHJlYXQgdGhpcyBhcyAiaW5maW5pdHkiLCB3aGljaAorCQkJCSAq
IGVuc3VyZXMgdGhlIGxvb3AgYmVsb3cgYWR2YW5jZXMgdG8gZW5kIG9mIHBhcnRpdGlvbi4KKwkJ
CQkgKi8KKwkJCQlpZiAocGdfYWRkX3M2NF9vdmVyZmxvdyh3aW5zdGF0ZS0+Y3VycmVudGdyb3Vw
LCBvZmZzZXQsCisJCQkJCQkJCQkJJm1heHRhaWxncm91cCkpCisJCQkJCW1heHRhaWxncm91cCA9
IFBHX0lOVDY0X01BWDsKKwkJCX0KIAogCQkJdHVwbGVzdG9yZV9zZWxlY3RfcmVhZF9wb2ludGVy
KHdpbnN0YXRlLT5idWZmZXIsCiAJCQkJCQkJCQkJICAgd2luc3RhdGUtPmZyYW1ldGFpbF9wdHIp
OwotLSAKMi4zOS41IChBcHBsZSBHaXQtMTU0KQoK
--00000000000097289a064ac8ed17--