MIME-Version: 1.0
References: <19405-1ecf025dda171555@postgresql.org> <CAMbWs4_GnG0NYnsBZJpHG-BLo28euD6VUx0WhFd4Ur6RaLr5WQ@mail.gmail.com>
 <b718571e-acc6-4e64-a238-15076a6ad0f0@gmail.com>
In-Reply-To: <b718571e-acc6-4e64-a238-15076a6ad0f0@gmail.com>
From: Richard Guo <guofenglinux@gmail.com>
Date: Sat, 14 Feb 2026 20:00:51 +0900
Message-ID: <CAMbWs4_jYG-vjN579aLuE7pf9PaZaPL9KCjPRN0kn3T+obE7hw@mail.gmail.com>
Subject: Re: BUG #19405: Assertion in eval_windowaggregates() fails due to
 integer overflow
To: Alexander Lakhin <exclusion@gmail.com>
Cc: pgsql-bugs@lists.postgresql.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://www.postgresql.org/message-id/CAMbWs4_jYG-vjN579aLuE7pf9PaZaPL9KCjPRN0kn3T%2BobE7hw%40mail.gmail.com>
Precedence: bulk

On Sat, Feb 14, 2026 at 7:00=E2=80=AFPM Alexander Lakhin <exclusion@gmail.c=
om> wrote:
> The patch works for me, but I've just discovered one more similar anomaly=
:
> SELECT SUM(i) OVER (ROWS BETWEEN 0x7fffffffffffffff FOLLOWING AND 1 FOLLO=
WING), i FROM t;
>
> ERROR:  XX000: window frame head moved backward
> LOCATION:  eval_windowaggregates, nodeWindowAgg.c:782

Right, I noticed this one too.  Basically, nodeWindowAgg.c doesn't
check for overflow when adding startOffsetValue or endOffsetValue.
Since these values are provided by the user and can be arbitrarily
large, simple addition does not seem safe.  I think we may need to
switch to overflow-aware integer operations in all relevant code.

- Richard