public inbox for [email protected]  

help / color / mirror / Atom feed

From: Richard Guo <[email protected]>
To: Alexander Lakhin <[email protected]>
Cc: [email protected]
Subject: Re: BUG #19405: Assertion in eval_windowaggregates() fails due to integer overflow
Date: Sat, 14 Feb 2026 20:00:51 +0900
Message-ID: <CAMbWs4_jYG-vjN579aLuE7pf9PaZaPL9KCjPRN0kn3T+obE7hw@mail.gmail.com> (raw)
In-Reply-To: <[email protected]>
References: <[email protected]>
	<CAMbWs4_GnG0NYnsBZJpHG-BLo28euD6VUx0WhFd4Ur6RaLr5WQ@mail.gmail.com>
	<[email protected]>

On Sat, Feb 14, 2026 at 7:00 PM Alexander Lakhin <[email protected]> wrote:
> The patch works for me, but I've just discovered one more similar anomaly:
> SELECT SUM(i) OVER (ROWS BETWEEN 0x7fffffffffffffff FOLLOWING AND 1 FOLLOWING), i FROM t;
>
> ERROR:  XX000: window frame head moved backward
> LOCATION:  eval_windowaggregates, nodeWindowAgg.c:782

Right, I noticed this one too.  Basically, nodeWindowAgg.c doesn't
check for overflow when adding startOffsetValue or endOffsetValue.
Since these values are provided by the user and can be arbitrarily
large, simple addition does not seem safe.  I think we may need to
switch to overflow-aware integer operations in all relevant code.

- Richard

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected], [email protected]
  Subject: Re: BUG #19405: Assertion in eval_windowaggregates() fails due to integer overflow
  In-Reply-To: <CAMbWs4_jYG-vjN579aLuE7pf9PaZaPL9KCjPRN0kn3T+obE7hw@mail.gmail.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox